The problem isn't crypto. The problem is that Javascript <i>in the DOM model</i> runs crypto code in an environment where you can't be sure what any symbol means, because any of a dizzying variety of page components or updates sourced on-site and off, under SSL and (most likely) not, could have modified them.