That would avoid transmitting the key to the server, but in the scenario I mentioned, it would still be accessible to the backdoor via window.location.hash.