Limitless_screaming

You’d have the server provide the code to your browser, and do the encryption/decryption client-side.

Yes, OP has a problem with this part. You’d have to trust the website to serve you the clean client side JS each time you use it. The proposal requires you to check the source code (which is plain un-minified JS) of the extension to make sure it’s doing what’s advertised when you download it the first time and with each update, instead of having to check the client side (obfuscated / minified) JS of every website each time you use it.

I would not install an arbitrary browser extension from Github. That’s just bad security hygiene. Extensions have way too many privileges, there’s not enough mechanisms to ensure that an extension is used only on the site that it’s intended for, and there’s no safe way to maintain updates.

That’s true, but auditing that one extension (even on every update), which may be used by other websites in the future, giving it more attention and audits, is a lot easier than checking the client side JS of every website.

If it’s a solid extension which could be used by other websites, and it’s explained clearly like in your post by the website which needs it, then probably yes.

Maybe because you can’t make sure the server uses the code it advertises without modification (The source code could be open and safe, but how can you make sure the website is actually using that?), while the extension is open source and could be downloaded directly from Github by the user. And if enough websites start using this system, it could gradually stop being an extra extension for that one website.