you realize that they dont have your private key right? and that you can verify the javascript wasnt poisoned by having a hash of the legit javascript and comparing it? with a handy toolbar?