Loaded into the proprietary signing vault. Encryption happens locally (RSA-OAEP-SHA256) — plaintext never leaves this browser. Engines fetch scoped keys from the vault at boot and sign locally (model B).
No secrets stored yet.