Served UI - The server hosts the web UI under `/ui/` with content-hashed assets, so browsers pick up changes without a forced reload.
Thin shells - The store packages contain only the connection page, a frame host and the privileged pieces: context menus, download interception and the E2EE session for the extension; native file open and Custom Tabs for mobile. Your private key never leaves the shell.