The MDN docs say this about Crypto.subtle [1]: "Warning: This API provides a number of low-level cryptographic primitives. It's very easy to misuse them, and the pitfalls involved can be very subtle.

Even assuming you use the basic cryptographic functions correctly, secure key management and overall security system design are extremely hard to get right, and are generally the domain of specialist security experts.

Errors in security system design and implementation can make the security of the system completely ineffective.

Please learn and experiment, but don't guarantee or imply the security of your work before an individual knowledgeable in this subject matter thoroughly reviews it."

There are many ways to fuck up using this. A couple of concerns about the article - I see no mention of a secure nonce, and no mention of CSP. I'm not a security expert, but I'd be very wary about using the code here.

[1]: https://developer.mozilla.org/en-US/docs/Web/API/SubtleCrypt...