The signature is checked here, in your browser: the secret goes neither to the server nor into the address