A digital signature requires the person/entity doing the signing to be the ONLY one with access to the private key. So by transferring the document AND the key to your server it basically invalidates the whole process as you can now forge the signature of the user.
The process works as follows: The private key transforms the original in a unique way. The public key can undo this transformation. So when I sign something with my private key and send it out, the public key can only undo what my private key does and not what your private key does, and that verifies that it was indeed me that signed it and sent it out and not someone else pretending to be me. Now of course, if my private key becomes compromised (say I get a virus, or some such that steals this information), then it is no longer guaranteeing that I am the one sending these documents.
On to your particular question:
If the user alone is to sign the document and they are the only one who is trustworthy to do so, then you have to send them the file and have them sign it and send it back. However, if the server in your system is going to be a trustworthy authority for the rest of the system, and you are trying to simply show that a document came from the user account it says it did, then you can generate a private key on the server for each user, and then sign each document with it.