That answer makes me think they're importing your private key into their server.

On the other hand one of their developers talked to me about my Dart bip340 library, which indicates they are either signing or verifying signatures on the client.