But you are downloading the client implementation from the server.

the server is trusted to serve valid crypto code. basically, unless i control the server, there is no way in hell i would be using this.