[twiss]

Correct, private keys can only be decrypted client-side, the server doesn't have access to the password that they're encrypted with. Otherwise it wouldn't be end-to-end encryption, IMO :)

[e12e]

But you distribute the js that accepts the passphrase - so you could trivially exfiltrate the password - and so access the private key.

"Don't have access" is a little too strongly worded IMNHO.

(I understand the reasoning - and I don't necessarily think it's bad - I just think it overpromises a bit)

[twiss]

Sure, fair enough. I've edited it to "the server doesn't have access". Also, see https://news.ycombinator.com/item?id=36643922.

[cuteboy19]

The app ultimately shows you your decrypted email. If client side code is compromised then I don't think this is the thing you worry about

[e12e]

Sending signed and encrypted emails is worse than just reading.