The encryption should really take place in a scope that content JS cannot access. I also think a system like this should be built completely parallel to email s

The encryption should really take place in a scope that content JS cannot access. I also think a system like this should be built completely parallel to email systems. Email is crap and needs to be re-invented as a web app with pseudo-anonymity and Public Key Encryption on by default. Users should not even know they are using encryption.