Hm yeah, use the web crypto APIs, do an AJAX request to something encrypted and decrypt it on the fly.