@cryptpad uses a cross-domain iframe to protect the main encryption keys from any possible cross-site scripting attack.
Everything is encrypted client-side so the server operators are oblivious to the content.
Synchronization is achieved using what is essentially a little blockchain.
Any news site that takes longer to load than CryptPad has NO EXCUSE.