Extractable Keys

A fellow developer point me at the Web Crypto API draft, when I was looking
into whether it would be possible to have the browser execute some key
generation process that would allow use of a secret key for encryption /
decryption, but would not allow that key to be extracted and sent elsewhere
with a Javascript call. I was wondering if the "Key.extractable" property
in section 11 was intended for that purpose.

The specific scenario I am interested in is if a bad actor is able to
compromise a website to deliver bad JS that attempts to extract they keys
and send them to their own server, whenever a user visits what is otherwise
a functional and previously safe site.

It would be very useful for a site to be able to generate a key, which is
could use via a handle like interface, but the site is unable to read the
contents of the keys.

Matthew