If you are trusting the host, why not let it do the encryption instead and make the whole system a whole lot more secure.

That is a true point :) But keep in mind that there is something to be said for not storing encrypted data on the same machine as the key.

Ofcourse once the machine is compromised it can trick you into giving it the key, but there are also countless scenarios where that is not possible. It is really an improvement onto your security.

Lets not pretend that read-protected memory is such a secure way of storing private keys.

If JS sent by server has access to your key, then by that proxy the server has access to the key too. The security is equivalent to having key stored in encrypted form and decrypted only for the duration of the session/use and the password not being stored on the server.

"Anyway if you control the host"

In other words, if the host is sitting on your desk. Chances are good that you have more control over the computer you type your messages on than some server you set up. What makes you think that the rack mount you left in your mom's basement is not being tampered with while you are away?

"your attack vectors are dwindling fast"

Now you need to trust both the host and your client machines, while before you only needed to trust your clients.

"Chances are good that you have more control over the computer you type your messages on than some server"

Wow really? I don't think those chances are good at all.. I'm not sure how often it happens that a running server is tampered with physically but I don't think that chance is as high as my client system running any malware beyond my control.