Why can't I just use web mail with javascript crypto?

There are more ways it can go wrong.

Javascript PGP in the browser has the very important advantage of making PGP more usable. But it introduces so many extra vulnerabilities that security people thought you didn't need to explain it. Then Google used javascript PGP in a browser. This is a detailed explanation of why you probably shouldn't.