And wouldn't TLS in this case protect the full session?
You still have to trust the source, but - it's on your machine. Go read it if you want?
http://www.matasano.com/articles/javascript-cryptography/