added the following:

1. creating of a 32character nonce
2. store to database object (WARNING: this needs a db migrate. I'll do it, just pointing it out)
3. in the main page view, a nonce is created and stored in the database
4. The page is then served
5. in the served page, there is now javascript (from static/js/helper.js) which makes an async request
   at a new "/nonce/" reout
6. If there is a nonce with value <nonce_value> in the database AND it's less than 60s old, then the stripe public key is served and subsequenctly set by a call back.

So the key is only available in a 60s window from request initiation to the client.

I suspect this will form only one part of a larger solution, but it is one part, and it is working.

further efforts to obfuscate the key will occur after implementing this, then rolling the key.