Small suggestion, you could make your entire script run frontend so the users can see what's happening to their keys, and attach some kind of sessionID to it on your backside so the auth checks against the stored sessionID.
This would eliminate sending keys to your backend. Crypto users will always be paranoid about sending keys to unknown pages.
That wouldn't work for apps that need to do stuff while you're offline, we're looking into trustless authentication though.