The lack of Ctrl is sadly a feature for web apps. You don't know which browser, and thus which set of shortcuts your user will be using your app from. However assuming that shortcuts will be prefixed is a pretty safe assumption, so the non-prefixed letters are really the only safe option for web app hotkeys as they form a relatively safe space of shortcuts.