i think it could be done securely by transmitting the key material via a secure channel directly from the phone to the browser or transmit messages directly enc

i think it could be done securely by transmitting the key material via a secure channel directly from the phone to the browser or transmit messages directly encrypted with the probably ephemeral key used for this secure channel. The secure channel could actually be build upon the the QR code you would give the app on your phone. No idea what is actually done though, just saying it could or should ^^ WhatsApp would of course still serve the whole browser application and could do whatever they intend to including leaking key material back home :) Not to mention that even if you opt to trust them not to do something shady or stupid like this you still have to trust DNS, certificate authorities, BGP routing policies, browser and platform security and likely a bunch of other stuff :P