Doesn't that mean the client holds the keys/secret of some sort is shared with the client so it can either generate or verify?