Comment by oulipo

This is quite common, you add the private key to some secure hardware module, so that only that device can sign using the certificate, and then use TLS to connect