Is Apia digital signature safe?

Apia digital signature bridges browser signing requests to a local native application via chrome native messaging.

When a user visits an Apia signing page, the extension reads a signing payload from localStorage and forwards it to the native host com.apia.sign running on the local machine. The native host performs the signing operation and returns a token, which the extension writes back into localStorage for the page to consume. No data leaves the local device through the extension.