notsecure

Not yet. This is a planned feature but the implementation has not been decided yet because this feature is not exactly compatible with how Tox works and it could cause a lot security issues.

The website should be completely functional with JS disabled (and it is for me), what issues do you get?

Note: I'm not in charge of the tox.im website, if it were up to me there would be no javascript at all.

Not any time soon, as iOS isn't very FLOSS friendly (in fact, the GPL is not compatible with the Apple app store). There have been talks of making a licensing exception, but the iOS client with the most progress (https://github.com/Jman012/Toxicity) isn't functional at the moment.