I think the crypto behind this is valid; weaknesses would be in implementation or in bypassing it.

There isn't anything inherently browser based about this.

I'm not a huge fan of browser based security (I know just enough appsec to be terrified).

If they had an API, it would be fun to do a secure mobile client for it (I trust iOS security way more than PC browsers..). There is less point when you have a client (just as easy to build some kind of key server with locally stored keys), but being able to send messages to future users is a nice trick.)

It looks like an interesting use of HSMs. I'm curious if they do real crypto in the HSM or just use it to protect a bootable VM. If it is just a VM, there are a lot more attacks possible.