The Sesame protocol lets the linked device generate its own keypair, the only thing in common is your user id. Each private key never leaves the respective device.
A talk on the technicals can be found here: https://www.youtube.com/watch?v=7WnwSovjYMs&t=1762s
