All JS is executed in the browser. If the malicious site wanted to steal the data, it must send the key to the server. With enough inspecting, debugging, and n

All JS is executed in the browser. If the malicious site wanted to steal the data, it must send the key to the server. With enough inspecting, debugging, and network watching you would be able to see what they're doing and how. While I agree you can obfuscate this in the JS payload, it doesn't make e2e encryption in web apps "meaningless". It would just take one user doing some due diligence to expose the malice.