if one already has ssl, but still wants to implement this, any d

if one already has ssl, but still wants to implement this, any downsides?

I think that none: In this case RSA/AES encryption will be another security layer to ensure your data when you use SSL/TLS.

I use both.

In the situation of a web browser, implementing something like this on top of TLSv1.2 with authenticated encryption cipher (ie the standard of a properly configured web server connecting to current version of Chrome/Firefox/Edge/Safari) is a waste of resources.

In general, if TLS is compromised, this type of encryption can be completely removed from the transaction and the web server will have no idea. There are a handful of very specific situations where it can provide value, but for the most part it just creates complexity without providing any additional security.

This tool was created for some programs I made for medical/health sector. In Spain the laws of personal data protection are very strict, and I have always had in mind the possibility of attacks on SSL / TLS. For these reasons I wanted to avoid falling into neglect based on applicable laws.

This mechanism is another step in data protection on servers where I do not control the implementation of the certificates or where the use of SSL/TLS is not forced by sysadmin.

No single mechanism is 100% secure.

I fully agree it's appropriate when you don't control the SSL/TLS. Most popular CDNs will terminate TLS upon their edge, and then transmit the plaintext data internally to the actual destination server. Great for performance, not so great for security.

I'm not abreast of the privacy laws in Spain, but I German's are a pain to deal with, and I wouldn't be surprised if Spain's were similar. In the US, you could have opened yourself to liability (yes the US legal system is messed up). If I can find your email address I'll send you more details.

I also agree no system is 100% secure since they all seem to include human users and 'hacking' a human is often the easiest route to compromising the system security.

The package definitely has use cases, they just are not as broad as many may believe. I just want to make sure less security-savvy developers don't see this package and think "Cool, I can now skip SSL!"

thank you all for the clarification. I now have enough information.