Allow bots to encrypt custom data using a user's private session key

It's said that Messenger will support E2EE (#8) for bot conversations, while bots will receive users' public session keys. Under these conditions, an extra feature can be very useful for bot developers:

Allowing bot frontend to encrypt custom data using a user's session key, via Javascript API.

Why this is useful?

Knowing

1. A user's device status is ACTIVE
2. The session with which the user is currently interacting (and thus the device platform)
3. The corresponding public key to decrypt data

A developer will be more confident that a request of the user is from a real mobile Messenger app since it's not easy to get the underlying private key without breaking the above conditions.

Messenger may allow calls to the API only from a bot context, such as the context triggered through clicking on a bot icon, and ignore calls from plain windows.

Things will be even better if the planed E2EE uses a different private session key for each bot conversation, because fraudulent bots will be hardly possible to mimic others. (Of course, this will be much more expensive)

At least, bot developers can use this API to protect some sensitive user info with ease.

No implementation files or tests are named. Start by reviewing the Messenger E2EE proposal in #8 and the bot-context and Javascript API requirements described here; done would require a decided design for encrypting custom data with the user's session key and a defined way to restrict calls to bot contexts.