The private key can be stored in the cloud but is decrypted client-side with JS. If you have nefarious JS running (like from some evil extension), there is a ri

The private key can be stored in the cloud but is decrypted client-side with JS. If you have nefarious JS running (like from some evil extension), there is a risk, but there is not the opportunity for man-in-the-middle.