Hacker News Reader

But you distribute the js that accepts the passphrase - so you could trivially exfiltrate the password - and so access the private key.

"Don't have access" is a little too strongly worded IMNHO.

(I understand the reasoning - and I don't necessarily think it's bad - I just think it overpromises a bit)

Sure, fair enough. I've edited it to "the server doesn't have access". Also, see https://news.ycombinator.com/item?id=36643922.

The app ultimately shows you your decrypted email. If client side code is compromised then I don't think this is the thing you worry about

Sending signed and encrypted emails is worse than just reading.