[MichaelGG]

No, I don't think this is correct. WebRTC requires you to trust the server (webpage) - there's no way to verify a peer. Think: from an end user perspective, what's the difference between an editor using websockets vs one using data channels? Nothing; they appear totally identical.

So sure, your data might go direct, offering therorical security. Similar to how Stripe and Braintree don't improve security against a malicious server (just change the form/js and it's game over), but help against accidental problems. But this isn't truly providing the end user any guarantees. But it's good marketing. Like Cryptocat.