If the key is encrypted with your password, I don't see how that compromises security by a lot. If they adapt the javascript to break encryption on a large scal

If the key is encrypted with your password, I don't see how that compromises security by a lot. If they adapt the javascript to break encryption on a large scale, that would sooner or later come out. Yes, they could target specific people, deliver different javascript and break their encryption, but in general it's still a huge security gain. It makes it impossible for Google to handover E-Mails retrospectively to police or spy agencies.