> as long as the device or the website are not compromised it is all good But that is THE problem. You are making yourself a huge target. The more users you ha

> as long as the device or the website are not compromised it is all good But that is THE problem. You are making yourself a huge target. The more users you have the most likely someone will attempt to hack you to use all those keys. The "client side" point is moot because the code that uses those keys comes from the server, once that's compromised all hell is loose.