But the browser could simply do verified transaction signing using known code. It severely lowers the trust barrier.