[tester756]

>If they're really being generated client-side, you're free to generate them yourself by any means you want. But also, that's a strange thing for the website to do

what??

Page loads -> Javascript sends request to backend -> it returns data -> javascript does stuff with it and renders it.

[thaumasiotes]

Sure, that's the model from several comments up. It doesn't involve signing anything.