Ah yes, you are right. That darn server-provided client-side code without any decent means of verification really wrecks a lot of security guarantees.