Well for this particular functionality whatever you use (website, app, etc) must have a valid apple developer certificate, so either the website must be up, the app's backend server must be up, or an offline app's bundled certificate must still be valid. All of these things will eventually stop being true regardless of the form the app/website takes.

I don’t believe the apps do it local either. They need to send to server to properly sign the pkpass. A server is being used regardless.