Can Web Cryptography API's native key object be reverse engineered in any way?
The Web Crypto API isn't intended to stop users from getting their own keys, or guaranteeing that to web pages. The Web Crypto API allows web pages to create and use private keys that the web page (and future versions of the web page) can not access; the API is about protecting web pages' keys from themselves.