If someone compromises the server hosting the PWA, he can put malicious-code inside the original one to steal your keys or executing malware.

You'll notice nothing, and be happy.