Either I'm not understanding you, or you're not understanding the tech. The website does not store any of the keys. They exist as a url fragment that only the u

Either I'm not understanding you, or you're not understanding the tech. The website does not store any of the keys. They exist as a url fragment that only the user has ever seen. So if I create an image today and encrypt it, only I see the key. If you hack the website tomorrow, you have access to my encrypted content, but not the key. Now that you control the website, you can modify the code so that the key gets sent up every time a user encrypts or decrypts something. But you don't have any access to anything created before you hacked it, if no user decrypts it.