I'd also considered that Java would be a more robust platform to build from. Its not quite as pure as javascript where everyone can see the code. But at least if it is open source, a determined user could check the bytecode check sum at any time and this should be a strong deterrent to fraudsters.
The problem with Java is the split between Oracle and Google, on top of that, one of the most popular device people use doesn't do Java, or Flash
And we do want something that works conveniently for everybody.
Verifying checksums doesn't help when there are likely to be regular updates to the Java client to patch bugs or improve usability/security.
Even a tech savvy person can't tell if it's a legit change or not compared to the number of web devs who can read Javascript easily. For this reason, the Javascript should not even be minified.