Comment by merelydev

Exactly my point, if you trust the server's js code to do encryption than might as well trust server side encryption.