Sending the private keys...even through HTTPs...is a security issue. Not only would you have to trust the connection, but also the middleware in place.
Ideally, the public/private keys will be only accessible to the client-side. What you send over your connection, is the signed transaction requests.
Essentially, based on your graph, I'd:
- Move web3 to the client size.
- Depending on how this is being built...create a bridge from native to web3js (unless there is native build already made)...this would be your REST API > to > web3 bridge.
- Have web3 connect > to > RPC directly.