These are the same arguments that we went through in 2012/2013 when we discussed cryptocat and encrypted webmail when we worked on openpgp.js.

Bruce Schneier also wrote a piece on it back then: https://www.schneier.com/blog/archives/2012/08/cryptocat.html

Unless browsers integrate the W3C web package format (which never shipped), I‘m not sure how these issues can be resolved https://github.com/WICG/webpackage