They aggregate the signatures but the proofs of identity exist on disparate publicly viewable sites/applications. They commit the state of the signature chain on the public blockchain. So I wouldn't call it completely "centralized"/trusted where you're blindly trusting their SQL database is correct but not "perfectly" decentralized/trustless either.