And more generally, the Lambda Papers by Guy Steele and Gerald Sussman, which also include "Lambda: The Ultimate Declarative", "Lambda: The Ultimate GOTO", and "Lambda: The Ultimate Opcode".
Yes, and you can trust your ISP and/or VPN and you have no way to tell if the origin web server is compromised and is serving malicious JS. HTTPS or not.