That&#x27;s an interesting (and accurate) point.  An interested user could verify the source of the embedded page, and ensure that it doesn&#x27;t change.<p>This also doesn&#x27;t protect the sender from a keylogger installed on their machine.  Private Forms is just one additional layer of security.<p>I also intend to add a warrant canary, but I felt like that wasn&#x27;t needed pre-launch.  This is definitely a high-priority item though, now that I have launched.