Thanks Classy, I could do that, it would be slightly less convenient when switching devices as you'd have to add the rom again but could be an option if there is ever any issues. Another thing I've thought about is client side encrypting any roms before uploading them. That would me I don't know if people are playing homebrew titles or something else.
Is it not legally safer for you to store only the save states and tell people to manage the ROMs themselves?