Comment by kevinak

You can just read the documentation: https://atproto.com/guides/overview#account-portability

“The signing key is entrusted to the PDS so that it can manage the user's data, but rotation keys can be controlled by the user, e.g. as a paper key. This makes it possible for the user to update their account to a new PDS without the original host's help.”