[snissn]

They could AES your keys before storing it in local storage and prompt the user for this extra key whenever they need to access your keys. Otherwise your private keys are just stored in a sqlite file or some other implementation specific file that your browser created on your file system.

[e12e]

And how would you ensure that the passphrase isn't transmitted upstream by a modified js-client?