You could pull the password, but you couldn't pull the private key from the browser (or plugin). Encryption/decryption is done in the browser, and the host ser

You could pull the password, but you couldn't pull the private key from the browser (or plugin). Encryption/decryption is done in the browser, and the host server acts purely as a data store, incapable of doing anything with that (encrypted) data. The trust question then gets moved from the host to the browser. Have you read the link I posted about how you could approach encryption at the browser level? Far from not solving the situation, I think they fall into the category of "half-way encryption is worse than no encryption at all", and they don't seem to understand the social concept of trust. As Jon Callas says, "Encryption is not magic pixie dust that makes everything okay."