In the usability/security tradeoff security companies will always try and scare you to the right (they make money doing so). most developers are comfortably being in the middle - after all, do we really need to implement signed client javascript (with all the problems and centralized infrastructure that imposes) just to store todo items?