Have you taken a look at Cyph (mentioned elsewhere in this thread)? Their app is also basically cryptocat, but they've taken the time to engineer an interesting solution [0] to the "Trust on Every Use" problem that secure web applications have.

Of course, you still have the problem of deploying a secure application within the attack surface minefield of a web browser, but that's a separate issue.

[0]: https://docs.google.com/document/d/1PGS50eZB9Ud7wVKmrc0HU_FD...