[fragile_frogs]

You can actually securely store a key pair inside of indexeddb by setting extractable to false [1]. You can then get a reference to the key and perform your allowed key usages without JS touching the key.

[1] https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt...