Comment by Qantourisc

Basically you give the user a device that has the private key, but never exports it. eID uses this: https://images.duckduckgo.com/iu/?u=https%3A%2F%2Fimage.slid...