Bring your own keys

Keys are encrypted at rest with pgsodium and only decrypted server-side at generation time. Your plaintext key is never sent back to the browser.