Possibly a good idea to mark them as clearnet, but all of them are prefixed with https so it shouldn't be too much of an issue.
JS is required. There's no way around that. Without Javascript, the service would need to handle the users keys on the server, which is obviously very bad. With JS, the keys don't need to leave the users browser.
But could there be a non-JS alternative?
Perhaps there's another way, a way that still doesn't require the keys to reach the server.