[xorcist]

> Shellvault could operate an untrusted intermediary

It's not entirely trivial. The javascript must be served from a trusted source.