They don't actually generate the key on the server but use the keygen element. This generates a key in the browser and doesn't send it to the server.