Which is why the web is not a good platform for important applications like financial apps.
Better would be client-side encryption where the server does not ever see your keys, like Open Transactions uses for example.
-MarkM-
I remember someone working on something like this for BTC. Something that ran locally in your browser, but interfaced with a remote site. Maybe I'm misremembering about exactly what it did, but I remember thinking it was pretty cool.

dunno what became of it though.