But the person entering form data - how do they know the JavaScript is OK? All users must trust the server to send js that&#x27;ll encrypt correctly. This isn&#x27;t visible to users. If you server is compromised, there is no way for users to tell, right? What actual reduction in trust is there for users with this system, versus one where the encryption happens on the server?<p>The only benefit I see is possibly some sort of legal thing or against an attacker that only has read access to server memory. What am I missing?