PWAs do run in the browser, just usually a sandboxed instance of it (on mobile).

Self hosting would be the safest, most paranoid friendly way to use one.

My client will be usable with any static hosting, and will be able to run entirely on the client using WASM. Pretty sure others can as well.

Windows or Mac users could try XAMMP or something similar, download the zip, and run it locally on their machine.

It’d be good to see some of these bundles as tauri or electron apps as well.