This looks like an interesting project, though you may find some people skeptical of using javascript in the context of sending secret messages. I could be in the minority on this one.

Wouldn't exposing window.ipfs on every web page add any attack vectors or break any domain security constraints?