[yuliyp]

It also potentially protects the passwords from their web servers if they implement it like that. They can pass the encrypted password to a separate service that has the private key and decides to give you a session or not.