I understand your point of view, but these are different levels of trust. You can audit the javascript they are sending you and (potentially) notice it is a ruse. If they are reading your email after you send it to their server though you have no way of knowing.