Server delivers ciphertext. Key is embedded in page JS. Browser decrypts via Web Crypto API. SWG only ever sees encrypted bytes.
Ready...