I think he's wrong. The server never receives the key. The bridge passes along the encrypted stream and encryption/decryption only happens client side. In the

I think he's wrong. The server never receives the key. The bridge passes along the encrypted stream and encryption/decryption only happens client side. In the demos, you can see that the parameter is a # parameter and not a query parameter.