does blockchain.info have everyone's private key? I'm looking at blockchain.info's FAQ page, and they describe the wallet creation scheme here: https://blockchain.info/wallet/technical-faq (please scroll down to the Please describe the wallet creation routine. section)

Because their wallet encoding tool is in Javascript, which is clientside, the user can trust that the encryption key cannot be on the server because Javascript must be all clientside code?

Is there any server side method in which the site could maliciously collect this data, therefore compromising blockchain.info's integrity?

Could blockchain.info suddenly change a line of code in their javascript, for say, a few minutes, and begin storing the pre-encrypted data into their servers without many people noticing? They could use this method to collect private keys from random samples of people, and would likely get away with it.
No, they have everyones encrypted private key. The private key get's decrypted locally on your client.

And of course they could change some lines of code and collect your private key. But this is true for every bitcoin client (thin client or not). That's why it is important to get the client binaries from trusted sources (and deterministic build).