> True, but they can trivially obtain them given they control everything in the browser.

Open source clients that you can self-host are available. I mean of course you still have to trust the code if you can't audit it. But hijacking your keys won't be as easy as visiting their webmail.