Edit: I understand your comment now. No, I meant that the bootstrap script is running in your browser. Yes, you're right that it's very far from perfect withou

Edit: I understand your comment now. No, I meant that the bootstrap script is running in your browser. Yes, you're right that it's very far from perfect without browser support for decrypting files, but it reduces the amount of files on the server you need to monitor to one (or a couple) and it would make targeting someone harder (by using appcache). I'm not a security researcher, though.