Comment by shayanjm

Off the back of a napkin - the key should never be stored anywhere first of all. In the absence of keyring/keychain/etc., it'd be trivial to introduce a masterpassword implementation in the browser client which is XOR'd with secret credentials and stored as such.

Obviously not a 'secure' system by any stretch of the imagination but it's an order of magnitude better than storing in plaintext.