after source code reading (and chrome dev console output observing) you have to realize:
1. there is need of 'signaling server'
2. session encryption keys are exchanged through that server
yes, anyone could setup their small server and call through it an make sure tls / ssl cert of their server is intact etc. that will not be a case for avg Joe. not to mention tat browser itself will be an attack vector.