&gt; Do you know what WebCrypto adds that TLS doesn&#x27;t? Nothing.<p>No, consider this: an end-to-end encrypted messaging web page delivered over TLS that stores keys in browser local storage.
A passive attacker that can see the incoming traffic on the server but does not want to alter the JavaScript sent to the clients will never see the messages. I argue this is weak but not useless.<p>(I would argue all TLS encryption in the browser is, in a sense, opportunistic to a certain extent, since very rarely people look at the address bar, effectively making it unauthenticated.)