Hydration connects two worlds
PHP renders initial HTML plus a signed description of state and behavior. Engine reads it, connects DOM nodes, and starts listening for declared events.
Why not execute arbitrary PHP?
Browsers do not contain a PHP interpreter. Compiling a limited language creates predictable JavaScript without eval and allows unsupported constructs to be diagnosed.
The trust boundary
The signature helps detect altered instructions. It does not make user input trusted and does not replace server authorization.