One quick correction: "an assertion is provided in the frontend and then the server sends it back to BrowserID to get the user information." isn't quite accurate.
All of the user information is available in the assertion. You can get at it locally, without having to talk back to us. We just have a web service that makes it easier to verify the cryptographic signatures on that blob. (And it is, of course, open source, so you can run your own if your language of choice doesn't have its own library for local verification.)
