The message is signed locally, before sending to the server. Private keys stored on smartcard can be used for this purpose.