Yeah, was thinking the same. At the end of the day any type of client-side javascript encryption is insecure since you'd need to prove the browser + runtime + js + algo are all kosher.

It's also sort of ironic that this extension is trying to protect your privacy against the same company making both the browser and the email service:)