Without a middleman server, this would require you to embed your secret key within the app, allowing your customers to access said secret key, which would allow

Without a middleman server, this would require you to embed your secret key within the app, allowing your customers to access said secret key, which would allow them to manage your Stripe account. Not a good idea. If you're not embedding your secret key within the app (i.e. you're only generating a card token using the public key), I don't see a problem with embedding a checkout form directly within your app, though that's rare to see.