IF you run the website yourself on your client then it's fine.

but ultimately the attack vector is much bigger having the keys compromised than having the keys in a local signing app on your computer that only signs.