I'm looking at blockchain.info's FAQ page, and they describe the wallet creation scheme here: https://blockchain.info/wallet/technical-faq (please scroll down to the Please describe the wallet creation routine. section)
Because their wallet encoding tool is in Javascript, which is clientside, the user can trust that the encryption key cannot be on the server because Javascript must be all clientside code?
Is there any server side method in which the site could maliciously collect this data, therefore compromising blockchain.info's integrity?
Could blockchain.info suddenly change a line of code in their javascript, for say, a few minutes, and begin storing the pre-encrypted data into their servers without many people noticing? They could use this method to collect private keys from random samples of people, and would likely get away with it.