I think he's wrong. The server never receives the key. The bridge passes along the encrypted stream and encryption/decryption only happens client side.

In the demos, you can see that the parameter is a # parameter and not a query parameter.

I was unclear in my comment. I was describing a before and after set of solutions. The former allows for server side decryption. The latter approach would prevent server side decryption.