Well, you could accept only certain javascript libraries, like with librejs and then it would be fine.

In Theory.

In Practice, no one dares to verify cryptography in the browser, because it's just not possible. but that's not the topic here.