How? As I get it, for a software to sign something it must be in possession of private key material. Then, anyone who knows the contract could extract the key

How? As I get it, for a software to sign something it must be in possession of private key material. Then, anyone who knows the contract could extract the key and do perform the transaction without bothering about conditions. And if only one party knows the contract, it could refuse to sign even though the conditions met. Or everything depends on a trusted third party that would keep and wouldn't disclose the secret part unless the conditions are met? And participants would only see a partial contract - i.e. conditions and actions minus the secret material?