A different threat model is that you have web applications with some kind of user-controlled encryption (e.g. keys only in local storage, never uploaded to the

A different threat model is that you have web applications with some kind of user-controlled encryption (e.g. keys only in local storage, never uploaded to the server) but an adversary tries to substitute a different version of the web application on the server-side that will leak the private keys or decrypt data and then upload it. That adversary could be a government trying to compel the web application developer to serve a compromised version to a particular user or group of users. At least, this is a threat model that I talked about with people who were working on similar tools a few years ago. Edit: for example, you could imagine a messenger application that has end-to-end encryption with a web version of the client. With traditional web applications, the developer could trivially substitute a backdoored version at any time in the future, and users couldn't plausibly detect that.