They don't pass the key to the website. They sign the transaction and present the signed transaction to be broadcasted. It works exactly the same way as a Bitcoin wallet works. If you've ever used a Coldcard, Ledger, Trezor, etc.