[moutarde]

The same server(s) also control the JavaScript code run by the client/browser. They could serve special code (to any one the government wanted to spy on) that returned their password to the server.

[rorrr2]

That's exactly why LavaBit shut down, looks like they were forced to do that.