WebcryptoAPI - secure or not
Personally I believe that it could be done properly and address all (or at least some) of the concerns. 

Remember what the WebCryptoAPI is: 


  This specification describes a JavaScript API for performing basic cryptographic operations in web applications, such as hashing, signature generation and verification, and encryption and decryption. Additionally, it describes an API for applications to generate and/or manage the keying material necessary to perform these operations. Key storage is provided for both temporary and permanent keys. Access to keying material is contingent on the same origin policy. Uses for this API range from user or service authentication, document or code signing, and the confidentiality and integrity of communications.


A lot of the concerns are related to how the code is distributed, hijacking the javascript/security of javascript engine, etc.

Well, for this particular standard, the code is distributed with the browser, not over the http socket. So at least the crypto algorithms should be safe. Furthermore, that would make it difficult for someone to say override the crypto code with attacker supplied code as browser checks can be added.

Hijacking of the content delivered by the HTTP server (say through XSS) to disable crypto or steal crypto keys is a concern. But, it is just a symptom of a larger problem.

It definitely attempts to solve some of the other problems such as key generation, key storage, etc.

A lot of this will depend on actual implementations, however.