all signer keys are generated and stored on mobile hardware so as a client I do not have to manage those keys? am i right or missing something ?