Because CircleCI stores private keys for the sake of deploying to your servers when your build passes.

It's separate from your actual codebase having any private keys, which I agree would be a Really Bad Thing.