> you need to know that the code you're about to execute was vetted by originating site and not altered in transit. TLS provides this.

TLS provides the latter, but certainly not the former. Many sites are serving JS that they cloned from some github repo and have never looked at beyond that.