Private keys stay in the browser: wrapped with a key derived via libsodium crypto_pwhash (Argon2id) from your password, then crypto_secretbox_easy. Only public keys are sent to the server.
Enable/disable outgoing is available per row in the directory once a link is active.