> You mean "the website" which is accessed over HTTPS and more likely than not has its key pinned internally?

Any website can run NaCl code, you realize that? Even TIDAL uses it on its site for native playback.

Even pages only accessed over HTTP.