Ahh yes, we did somehow manage to misunderstand each other completely. There is no scenario in my system in which the browser sees any keys or passphrases, encr

Ahh yes, we did somehow manage to misunderstand each other completely. There is no scenario in my system in which the browser sees any keys or passphrases, encrypted or otherwise--that would only happen in a signed standalone client program capable of running native code. (The browser does see a password in the potential "send-only" scenario I described earlier, but that's a separate secret unrelated to the PGP key.) Yes, it would be possible to maliciously alter that code and redistribute it, but it would be difficult since the source would be open and anyone could verify the hash. At that point, it's probably easier to just infect the host computer with a keylogger some other way (and wait for the user to lose their key so that they need to use their passphrase, then intercept 2 factor auth somehow), but that's like the deus ex machina of computer security (and still not at all automatable at large scale as far as I can see, especially due to 2FA).