The OPs point is very clear. Js encryption has a lot to do to prove itself before it should be trusted with production secrets. Furthermore weak encryption is

The OPs point is very clear. Js encryption has a lot to do to prove itself before it should be trusted with production secrets. Furthermore weak encryption is worse than no encryption if it encourages dangerous behavior. I would add that dropping ssl because you are using something like this would be dangerous behavior.