What is so wrong with Web Environment Integrity? It's a great policy, and the notes CLEARLY outline how the main benefit is going to be for the users and website developers. If you're not doing anything wrong, then you shouldn't have an issue.
If someone else has the key, it's not safe encryption. It's only as safe as the entities holding the keys. Do we know that they won't sell? Be forced? What happens if they get hacked?
Now it's not your security you have to monitor, but theirs. And you can't control theirs.
Isn't that the same argument for the receiver of a PGP email? How do you know they won't sell your email, be forced to, or have memory stealing malware on their machine reading all emails?
