My understanding is that with the WebRTC peer-to-peer data API, communications between peers are encrypted via a modified form of SSL. Where are the keys for the peer-to-peer SSL connection generated, though? On the original web server that unites the peers, or on the peers' computers?
Update:
SpecificallyAlso, assuming that the JavaScript delivered to their browsers is not already siphoning off their data, I'd like to know if it's possible for the original uniting web server has enough information (keys, etc) to eavesdrop on the united peers encrypted communications, assuming thatif the JavaScript delivered to their browsers is not already siphoning off their datatraffic was recorded, for instance.