Keys are encrypted server-side with APP_SECRET_KEY. The browser only receives preview and configured state.