Private keys are now generated on the client using the Web Crypto API and never transmitted now. Merry Christmas all!