There's no stopping anyone from packaging the current web client as a stand-alone program, though.  With the javascript Curve25519 implementation, it should be possible to sign transactions locally, too, and safely point the web client at a public node.