That really doesn't change the equation. That's only if you can trust the client code...and it just isn't feasible with JS sent to you from a 3rd party.

pgp works because it transfers data and not code.