Keys are encrypted in the local SQLite database with a passphrase stored in data/.secret. They never reach the browser.