That's why I specifically mentioned web browsers. That implies the key is on the server or sent to the server and thus it's possible to intercept or recover it.

That's why I specifically mentioned web browsers. That implies the key is on the server or sent to the server and thus it's possible to intercept or recover it. You need a trusted client on the end users device and the key must never be passed to the server to be considered secure.