It's also only as secure as his javascript that you are downloading (from his server) to encrypt the message with.