I'm really disappointed in SAQ A-EP. I feel that as a web developer, there are just way too many questions that go over my head and I couldn't possibly know.
I use primarily Stripe and Braintree in my e-commerce solutions. So, there's this article of interest:
The entirety of all payment pages delivered to the consumer's browser originates directly from a third-party PCI DSS validated service provider(s).
Furthermore this article states:
Merchant website provides an iframe or URL that redirects a consumer to a PCI-compliant, third-party payment processor, where no elements of the page originate from the merchant website.
To me, it sounds like Stripe still puts people under SAQ A-EP. Or PCI is very unclear, because both SAQ A and SAQ A-EP say that an iframe is acceptable.
But regardless of that, Stripe.js does not use iframes at all, so it seems to me it doesn't make one eligible for SAQ A.
My mistake. After looking deeper into the Stripe.js code, I can see it's dynamically creating an iframe. I'm not sure what it's doing with it, but I'm sure they're performing some sequence of steps to be SAQ A compliant.