The private key is the rsa private key that is saved on the server side.  They are just doing something strange by signing with the public key in the client. I'm hoping someone on the Blesta end can shed some light onto why it is done this way as most libraries won't let you do this. This is the stackexchange post I found about signing with a public key for whatever, if anything, it is worth https://crypto.stackexchange.com/questions/2768/signing-with-public-key