Interestingly, the technology of Signed HTTP Exchanges could potentially be used as the basis for a system that removes the need to trust the server. The current Internet-Draft even includes a section on the Binary Transparency use case:

https://wicg.github.io/webpackage/draft-yasskin-http-origin-...

What's still missing, I think, is a way for a publisher to tell a browser "Only run new code from this domain after checking that the user is happy to upgrade". That would put the "web app" on roughly the same security footing as a desktop application with a built-in update system.