I believe technically it "computes" the private key on the fly as you need it (it's derived from the master key plus other factors to make it unique per site/user).