[dane-pgp]

For what it's worth, this Principle Of Least Authority / object-capability model is being attempted in the JavaScript ecosystem with SES (Secure ECMAScript).

https://agoric.com/blog/technology/ses-securing-javascript/

https://medium.com/agoric/pola-would-have-prevented-the-even...