I suppose there is the possibility of a hacker changing their actual content so that things AREN'T done client side, and therefore being able to decrypt the key

I suppose there is the possibility of a hacker changing their actual content so that things AREN'T done client side, and therefore being able to decrypt the keys. In that case any user who used their site with that malicious code would be compromised. That is a very real threat, I grant you that, but it is a hell of a lot better than what the state of the art was a year ago when a hacker got everybody's information once they got root.