True, but they can trivially obtain them given they control everything in the browser.
The question then becomes, does the law allow compelling to that degree? Apple fought back in the San Bruno case, but they’re very well lawyered up
Open source clients that you can self-host are available. I mean of course you still have to trust the code if you can't audit it. But hijacking your keys won't be as easy as visiting their webmail.
Is there a clear definition between handing over data they have and being compelled to make modifications in order to intercept?