How does this work implementation wise? One private key per application? Per user? Or refreshed on a per-login basis on the first POST?