Your private key never leaves your hands.
Every config gets a fresh WireGuard key pair, generated on the device that will use it. Only the public half is sent to the node, so the operator carries your sealed traffic without ever holding your end of the tunnel.