On the subject of private keys: I'm pretty nervous about the fact that the private key lives and needs to be handled (e.g. copied / pasted) in "close proximity" to the public internet (e.g. in a browser extension or a client app).