I think the cryptr module on NPM would be an excellent option for this. There'd need to be an extra env variable for storing the serverside key, the FIREBASE_APIKEY variable could be a fallback since all that is needed is a random string, but I think it would make the software seem more secure. I can work on a PR to add this