It's end-to-end, clients store the keys.