I have thought about this, and I would pay for a well engineered solution for which the operators are open about the inevitable limitations. The issue of JavaS

I have thought about this, and I would pay for a well engineered solution for which the operators are open about the inevitable limitations. The issue of JavaScript being manipulated by the operator to steal your passphrase/key is tricky, as mentioned by others. You might be able to do the crypto part in a separate scripting context via code stored in HTML5 local storage after you've reviewed it once, and using window.postMessage() in some way? The plaintext could be displayed in an IFrame running in that local context. Then there's the issue of unencrypted incoming mail. You'd need to trust the SMTP server operator to encrypt any incoming mail with your public key and then destroy any record of the plaintext. Metadata is also an issue: you'd want to encrypt headers as well as the body, as knowing when you communicate with whom is almost as valuable as knowing the content of said communication. Encrypting it is easy, indexing it for efficient access less so. Still, this could exist as a self-hosted package for the more paranoid as well as SaaS.