This was my thought given the browser trust model, the server would just have to deliver a payload to the client and let the client send the encrypted data back

This was my thought given the browser trust model, the server would just have to deliver a payload to the client and let the client send the encrypted data back to it.