Right, I hear that, and encourage it!

I'm asking how some folks can say that the keys are NOT on the server when it's using one of the Lightning-node-as-a-service LSP providers.

The keys MUST be hot and on the server. aka the LSP provider CAN access it. Am I wrong here?