It's on them and on web developers, who then have to deal with a balkanized client space without even the courtesy of a standard to allow the page to detect whether a given decryptor is available.