That's not correct - the site asks for a CSR, which doesn't include your private key. The private key (and ACME account key) doesn't leave your device.