Because of the way asymmetric cryptography works, your secret key is never sent over the internet to any server, not even Cotter's server. We only need to verify that requests are actually made with the key using cryptographic functions, to ensure that it is actually coming from your Trusted Device.