The service I'm creating is an anonymous blogging website with a '.dev' extension. It will be made for developers, who are more technically inclined.
The reason I am intentionally not considering user device security, is because with this method, I intend to give users ownership of their data. They own their computer, they own their security. I just want to provide a secure means of blogging where they dont have to worry about my server being compromised, because if it is, the attacker will only see sha256 checksums associated with user posts/comments. The posts/comments themselves will be publicly available just by visiting the website.