Doing crypto on the client side in JS is absolutely the correct way to do this if you want E2EE with a web client. You need to be careful about supply chain attacks etc.

> To me, this smells like Crypto AG

It's easy to throw around unsubstantiated, impossible to disprove theories.