Comment by lclarkmichalek

Still would only be as secure as https if the client is downloading your JS crypto lib every visit.