I don’t believe the apps do it local either. They need to send to server to properly sign the pkpass. A server is being used regardless.