&gt; <i>browser Javascript, which can only be as secure as the server&#x27;s verified TLS key anyways (and thus doesn&#x27;t add any security TLS doesn&#x27;t)</i><p>This is not precise.  While it does not stop even the most basic active attackers, it does prevent passive logging on the server without changing the served JavaScript, therefore making undetectable mass surveillance on the server harder.  The effect is analogous to the difference between TLS with and without forward secrecy: with a similar argument you could conclude ephemeral DH&#x2F;ECDH does not add any security to TLS, which is not quite the case.