Personally I believe that it could be done properly and address all (or at least some) of the concerns.
Remember what the WebCryptoAPI is:
Well, for this particular standard, the code is distributed with the browser, not over the http socket. So at least the crypto algorithms should be safe. Furthermore, that would make it difficult for someone to say override the crypto code with attacker supplied code as browser checks can be added.
Hijacking of the content delivered by the HTTP server (say through XSS) to disable crypto or steal crypto keys is a concern. But, it is just a symptom of a larger problem.
It definitely attempts to solve some of the other problems such as key generation, key storage, etc.
A lot of this will depend on actual implementations, however.