The nsec lives in the nsecbunker (on a server somewhere). So whenever an event needs to be signed, the raw event is sent as a payload to the bunker where it is signed and returned.