Really, this is the only secure way to do it. SSL for the online portion is nice but still requires the user trust the person serving the site. Running both portions locally, on my online and offline computers, is the only way I'd consider using this project for a significant offline transaction.
what are the security implications exactly? Simply that the destination address could be altered, and then the user may overlook this when signing offline? or can other things be done by changing the blockchain data or other stuff?