To employ end-to-end encryption, I am using a small tool that encrypts contents that is then posted and stored on our servers. While there are several concerns on client based encryption, I think it is better then no encryption at all.
The tool is not delivered by the web pages itself, but stored on a trusted server and injected by Browser Extensions or Bookmarklets into the page we want to use encryption on.
For now, the pages where the tool is used are under our control too and somewhat trustworthy. However, I like to use the tool on third-party pages too, like webmail sites.
That makes me wonder about how a malicious (or even just a sloppy) website may threat the encryption, eg. by funneling the key or plain text to the server. Is there any chance of sandboxing the injected JS, or do DOM events and JS namespaces provide access that cannot be blocked in any way? How large are the chances that "good" sites will siphon the key by accident?