I don't think you can do this safely without having a security person on board. And there's a chance they'll try to ship a real crypto library in the Electron app.

I'll give it a shot though, some things that come to mind:

* RFC6979 ECDSA or bust

* Have you considered off-curve attacks for that ECDH?

* How do you authenticate your symmetric ctexts?