It actually started out as a web app, but the web as a platform is unfortunately not at the point that it can be relied on for zero-knowledge encryption.

In short, the goal is to not have to trust the server, but if the server is delivering you javascript and html, there's no way to avoid trusting it.

Browser extensions are another problem--there's no way to block a browser extension that has been given page-level permissions from reading the DOM, so managing secrets in your browser means implicitly giving access to a lot of different third parties if you use extensions.

I was part of the Beta when it actually was a web app. The reason I was told for switching to a native app was that it's much easier to secure a native app vs a web app. I think browser extensions are one of the big reasons for that.