[Someone]

"You'd have to already be sending back and forth some pile of data"

I would probably attempt to do it by only loading data. Use some bits of your locally generated pseudorandom bits to select a set of random bits from an external site to supposedly increase the randomness of the data (yes, that's nonsense, but less obvious then uploading the key directly), but though the sequence of requested URLs leak the locally generated pseudorandom bits and thus the key.