i only use it locally on the same device as a client, so assumed it signs locally, but makes sense for general case..