You could embed Jython in a Java applet on a web page, and that
would
be as secure as Java is. Of course, you wouldn't be able to use
pygame, because it's not pure Python.
Ah, but apparently you could now :D
http://sdljava.sourceforge.net/
Muahahahahaaaaaaa!!!!!
Unfortunately not. :-( That's an SDL binding for the Java language,
still requiring the end user to have the SDL libraries, and *those* do
not (yet?) come as browser-downloadable-and-executable Java applets.
That is, even having a Java *interface* to SDL, one would still need a
Java *implementation* of SDL (and in the form of browser applets, no
less).