Hey, @bnewbold.net or @pfrazee.com ! Quick question. In atproto, is a users private key held by their PDS or the user themselves?

I'm trying to figure out how a key-pair is generated and used for signing content but struggling to find the right docs.