Ask HN: How to operate on encrypted files in a locally restricted sandbox

I need to operate on encrypted files in a local sandbox. This means I want to limit local access to the key and unencrypted file. I want a script to ping a webserver to securely pull the key in a JS environment, use this key to unencrypt files, operate on them, and send information to the webserver without the local user having access to any outputs or intermediates. Is it possible to locally sandbox in a submitted script so that it runs locally but what it is operating on is completely unaccessible to the local machine after submission? (only accepts inputs - outputs, intermediates in memory unaccessible)