The best way to do this is to have the client do all of the signing and transmit transaction data to the server. No secret phrases would ever leave the client.