Currently transactions are being signed at backend which is poor security design in current use case, especially when it comes to login.lisk.io which is used by most users. It relays on one central power. Im aware if there will be provided bundled packages this doesn't matter much anymore but still it will be issue if we decide to use online wallet like login.lisk.io it's still better to do not send passphrase anywhere.
Courtesy of @karek314