Or you do both. If your using SSL you still have to trust the server, or anyone who gets access to it. Encrypting in browser at least means the server doesn't

Or you do both. If your using SSL you still have to trust the server, or anyone who gets access to it. Encrypting in browser at least means the server doesn't intensionally have access to the plaintext. That means if the server is stolen/ceased the plaintext can't be accessed. However you are right of course that it doesn't protect you against a malicious agent who has access to the server over a period of time. It seems like it should be theoretically possible to do that though, but it would require browser capabilities that we don't have at the moment.