OP's point is, as a consequence of providing "useable security", the secret keys remain "exportable" (in this case, unwrapped in a URL fragment), which is an undesirable trait in some threat models. Let alone web-based cryptography, which in on itself is perilous: https://news.ycombinator.com/item?id=39436238