> What I'm working on at the moment, and am sort of stuck on, on is how to make a web app doing in-browser encryption secure

You can't. End of story. Thankfully, most people don't care and will happily use it anyway.