The problem is that they're trusting the integrity of that client-side code to their servers on each use, which is in practice not meaningfully different from a

The problem is that they're trusting the integrity of that client-side code to their servers on each use, which is in practice not meaningfully different from a traditional non-E2EE email service. The only difference in attack pattern, in the event of a server compromise, would be that the attacker would have to send you a line of JS to steal your password/key before reading your emails.