I did not review the code either, but this is how I believe it works. Both keys are stored in local browser storage unless you use a signing extension, then only the public key is stored there.