Nope they have stored the keys in a cookie. Now they store them in the local storage but other than hivesigner they are encrypted with a pincode. On top of the cookie thing they have sent the private key over the internet at the beginning - thats when the whole thing blew off