If they are astute in cybersecurity, they will be using other (and secured) browsers.
Also, I use Vanadium with JS disabled, which is already decently hardened imho. Yet, your choice of key exchange bars me from your site.