> "Web apps" are always going to be 2nd class apps, because it is insanity to allow the spoofing of the native UI.

You're right that it's insanity to allow a web app to spoof the native UI. But extensions aren't web apps: they are native (or should be).

Extensions are extensions to the browser: they're what can actually provide secure crypto and privacy.