I think he was suggesting that, instead of sending the private key to this web server, the check they're doing could be implemented client-side, thus avoiding t

I think he was suggesting that, instead of sending the private key to this web server, the check they're doing could be implemented client-side, thus avoiding the need for the key to transit the wire. I haven't been able to access the site though, so I may be way off in my understanding of what it does.