@upshotknothole @espectalll @micahflee Yes, of course the signing needs to be done on the user's machine. It needs to be part of the web protocols and browser functionality.

(Which brings us back to Qubes - the VM you toot from needs access to at least a low-grade signing key so probably ought to be separate from the one you do most of your browsing on.)