The wasm code runs in the browser, hence the keys live in browser memory, so the browser has access to the keys.