Keybase always performed crypto on-device using their open source client written in Go. What not-your-keys not-your-crypto setup are you referring to?