OpenPGPjs has passed an independent security audit
Not that it matters. They could silently replace it with a backdoored script and your browser would never tell you it happened.And to preempt the ProtonMail rep who is probably going to respond to this comment, I know that you can run the web app on localhost. But that doesn't mean that users who don't are any more secure.