That is definitely the "secure" answer. Allow me to make a prediction, though: WebGL will happen. Browsers have always largely ignored security concerns ("what do you mean, twenty-year old crufty font rendering code perhaps shouldn't be directly exposed to the internet?"), and they are not going to stop now.