You can checksum the whole page, but any externally loaded JS can monkeypatch any other part. Use analytics? How about a payment widget? All of these can affect every part of the js environment, overwriting anything from jQuery to sjcl. Alternately, they could leave the crypto alone and just hook into keystroke handlers or the DOM and steal your plaintext that way.
Also, some browsers will run JS from urls referenced in img tags as long as they are served with a text/javascript MIME type.
Also, some browsers will run JS from urls referenced in img tags as long as they are served with a text/javascript MIME type.
It's far too big an attack surface.