The session key is for autofill, like what autofills during MFA. Whatever is stolen IS okay, because every request to the server encrypts using that session ke

The session key is for autofill, like what autofills during MFA. Whatever is stolen IS okay, because every request to the server encrypts using that session key which is stored in the cookie, the random string that the server send to the user inside a JWT, which can’t be modified and the server checks that the result of the encryption is what it supposed to be. The browser defends from stealing the cookie, however if SSSL is broken hackers can sniff anything they like. Which in this case will not help them anymore. And it’s easy to implement (for me) hence I want to offer it to novice users for a small cloud usage fee. Maybe like 5 dollars a month for 1000 requests, 15 dollars for 10,000 requests, 50 for 50,000 and 500 for standalone server. What do you say?