That may solve some of the distribution problems, but no browser-based software can ever be truly secure for a different reason: you have to run the crypto in the same process as the network and parsing code. All browsers have a history of security issues and other bugs in these areas. We should be minimizing attack surface, but browser designers instead decided to add more features that inevitably lead to more bugs.
The browser is an incredible "weird machine"[1], and relying on them for security requires believing that nobody will figure out how to program that "weird machine". The solution is something in the style of the "agent" programs[2] for ssh/gpg. The crypto - especially the private keys - must be done in an isolated process, so buffer-overflows and parser bugs at worst leak only the current data. If the crypto is handled in the browser itself, there is always risk that a bug will allow the keys to be leaked.
[1] https://media.ccc.de/v/28c3-4763-en-the_science_of_insecurit...
[2] ssh-agent(1), gpg-agent(1)
A lot of people are researching solutions like the app-cache approach to try and fix this, fortunately it's getting better!
Why not use PGP then? It's not hard.
gpg isn't difficult to use, hell my grandmother could do it. Concepts like private keys (this is the key you keep private) and public keys (this is the... well, public key) are trivial to understand.
You don't need to understand the technical details of encrypting and signing messages either, you just paste in the message and the pubkey key and encrypt.
It's by far the best email encryption solution we have right now, and I seriously doubt we'll be seeing anything better any time soon.
Yet any research we have shows that people, even technical people, make simple but critical errors.
The bottom line is that yes, this sort of setup would be worse than PGP email, but it would still be better than traditional web mail which the vast majority of people use.
On an interesting aside: You don't have to audit the code every single time. On first execution of the code, it can store itself in the browser's application cache indefinitely, and manage upgrades in the same style as traditional software. This is fairly new ground though :)