This is very cool, but how do you limit an end user to only being able to read a given set of values. It seems to me that this scheme puts all credentials for access in the browser, and they'll be able to just run roughshod all over your data without constraints in place.
Can you create data spaces/keys for ones that are read-write per-user and others that are read-only for a given user?