When you say passive web page, do you mean a simple .htm file with no php (or other) server side language? Or do you mean it's fully managed by PayPal using a gui/admin portal?
If I could insert trustworthy code such as javascript into my page, that executes on the user's computer, that would be a fine compromise.
I'm not anti-tech, but I feel that spinning up my own server (even on a cloud computing instance) would be a lot of complexity for my tiny business. I don't even know where to begin, should I want to secure such a server. I'm a good programmer, but have not done that kind of work before. I also don't trust my own skills to protect my users' security.
Finalizing the transaction does occur at PayPal's site.