But this is a web app, so the encryption happens in a blob of JavaScript that you can update at any time. Users still need to trust you as much as they would if

But this is a web app, so the encryption happens in a blob of JavaScript that you can update at any time. Users still need to trust you as much as they would if the data was encrypted server-side. You could maybe claim "application-level" "rock solid" encryption if your app was entirely implemented within the extension, so users could at least pick one version of it to trust, but it doesn't look like that's what you did?