Firstly, thank you for your time and effort, and secondly, apologies for delay, I thought I would get notified but I didn't :(

Yes! As it happened I started thinking about PGP myself which seems to fit in with your last comment and I am going down this route. My idea is that the BE will have a static public key which will be in the JS being served - this will add an element of visibility to anyone who cares to check that JS. I could even add a way of checking the JS externally by the BE every minute for changes to it's checksum (in addition to the FEs own IDS).

There gets a point where adding more complexity will mean users won't bother using us. I think this is a pretty good implementation and really the chink is the password setting, but with BE checking the JS and the public key being visible then it would seriously diminish the impact of this. I have also decided against 'PIN' and using 'Authentication Password' instead, basically, a second unique password so will have much better entropy. Thank you!