They have the private key encrypted and they transmit it to you to decrypt locally in client side JS.
This is how they're able to send you encrypted backup wallet files via email and such.
Interesting. So Blockchain.info actually knows the unencrypted private key?