The "secure unless" list needs to include:

* Author of page is malicious.

* Operator of server is malicious.

* Anyone with access to the network between you and the server is malicious. (no HTTPS)

* Google or anyone who has compromised their infrastructure is malicious (has embedded google js on the page).

* Likewise for 'bootstrapcdn', 'jquery.com', or cloudflare.

OTOH, it uses window.crypto and doesn't silently fall back to insecure randomness like 95% of JS crypto that I've looked at...

:)