Don't you as the sysadmin have access to the keys though? Even using an evercookie or something like that -- I fail to see what prevents you (Your malicious twin lets say) from seeing these?
The key (which is generated from the password), is stored using localStorage while the user has the app unlocked. I could certainly send myself the key somehow, but the concerned user should be able to snort that out fairly easily. I guess one option would be to opensource all or part of the js.
So if I blow away my local storage I'm hosed?
Doesn't sound like it. The key would probably be regenerated from the password and stored in localStorage again.