This reference installation of the site doesn't use SSL/TLS, and sends the supposedly "secret" message in the clear over the wire to your server. The decryptio

This reference installation of the site doesn't use SSL/TLS, and sends the supposedly "secret" message in the clear over the wire to your server. The decryption key is also transmitted in this manner. As someone else mentioned, the decryption key has almost no entropy at all. Any upstream provider (your internet cafe, ISP, FBI, etc.) or the site operator (OP) can read your "secure" message with almost no effort. This is false security.