Would you do this by creating your own EME in a cross-browser manner? I guess the built in support for basic encryption would work here (the mandatory profile)

Would you do this by creating your own EME in a cross-browser manner? I guess the built in support for basic encryption would work here (the mandatory profile). You could even deliver the symmetric key out-of-band with asymmetric encryption.