The NSS code is careful to zeroize all the buffers that hold keys when the keys are no longer needed, in order to minimize the impact of reads of freed memory and similar errors. The JavaScript interpreter doesn't have the same mechanism for its Strings and the JavaScript interpreter has a particularly large attack surface, so we should avoid storing encryption keys in JavaScript strings to minimize the risk of their disclosure.