The OS/browser could give this capability to web apps via an API.

That would be a breeding ground for malware.

The capability to ...read their own keys that they set up?

You mean like the android play store already is?