https://bitcointalk.org/index.php?topic=309785.0
BitcoinTalk.org includes Baron in its security bounty program because it intends on using it within its own infrastructure. If you find a way to break it you can earn some serious money.
That's correct. Currently it requires private keys on the Baron server, which means the wallet must be encrypted and backed up often. Encrypted means the keypool must be refilled periodically.
If there is sufficient demand it would be theoretically possible to include watch-only support so the Baron server need not have private keys online. Ideally this would work with a Hierarchical Deterministic wallet where the server does not need to be periodically refilled with unused addresses.
Hypothetically this could be done today with a javascript library that generates the public addresses as needed. I am not sure if such a library exists at the moment?