You won't need any SSL. A user's typical first interaction with notecrypt will be through http://notecrypt.appspot.com http://notecrypt.appspot.com (which just

You won't need any SSL. A user's typical first interaction with notecrypt will be through http://notecrypt.appspot.com http://notecrypt.appspot.com (which just needs to evil reverse proxy to the actual site or an emulation, while backdooring the javascript to send the password somewhere). The client never sees any SSL.