Replying to @Chronotope
Right, that's been my impression. I mostly wanted to make sure of that before I start writing up something. The more I think about it, the more I like the trusted server model (because browsers are hard to audit, and some have chequered history), but it needs governance.
♥ 2