Protect JS crypto keys from XSS, using iframes and postMessage | Hacker News Reader