and if someone cracks into the cloudfront account and modifies the js... not good...
In that case, I think the best route is to take the html and add it to your site yourself. You can actually even host the js locally if you want. The call to our geoip server just returns json, so shouldn't be a threat: http://geoip.taskforce.is/
But if you want to host that part as well, it's open source too: https://github.com/tfrce/node-geoip-web