Should window.crypto be specified to be non-configurable and non-writable?

Currently, the spec doesn't say whether window.crypto can be modified by Javascript code. So any implementation that leaves window.crypto open to being changed would be seen as conformant (example).

Leaving window.crypto open to being changed by, say, browser extensions means no piece of code that uses window.crypto can trust it and therefore no security guarantees can be made by any piece of code that runs in the browser. That seems to invalidate the primary declared purpose of the library. Should a crypto API tracer even be installable by a normal user whose primary trust point is the browser and not extensions? Would the lack of trust cause libraries which need crypto to try to ship their own implementations which would defeat the purpose of the specification?

Start with the Web Cryptography API question about whether window.crypto may be modified, then review the linked Chromium issue and crypto API tracer reference. Done means the specification has an explicit decision on the required configurability and writability of window.crypto, including the stated trust implications.