Both. By default, the software wallet sends serialized transaction which gets deserialized in a device to display everything to the user before it's accepted and signed. But there are hardware limitations like CPU and RAM, so not every transaction could be signed in such flow - therefore there is a second option to sign only the digest of the transaction. This method is disabled by default and needs to be explicitly enabled in the Hive app in settings.