> 5. The web app's client sided code, JavaScript, sends the message to Alice's pygpghttpd listening on localhost So either you're trusting the web app's js, or

> 5. The web app's client sided code, JavaScript, sends the message to Alice's pygpghttpd listening on localhost So either you're trusting the web app's js, or there's some other unspecified mechanism for ensuring that it's behaving in a trustworthy way.