An oldie, somewhat OT.
I enjoyed CF's bit of engineering here - of course CF is still a point where they are working with injectable plaintext. At least they don't have your private key material.
https://blog.cloudflare.com/keyless-ssl-the-nitty-gritty-technical-details/
What would be solid is if there were a browser module that did several things:
Eliminated JavaScript dynamic calls (eval, new function(), setTimeout, setInterval, so on.)
Eliminate 3rd party assets.
Allowed web assets to be signed.
Allowed sets of web assets to be versioned (and attested to by 3rd parties.)
Dynamic HTML and JS (read, non-static HTML & JS) would not be supported.
The combination of signing, versioning and lack of dynamic features paves the way for uninjectable, client-side in browser encryption/decryption. Something AFAIK we cannot do today. Is anyone working on it?