With smart cards (EMV, PIV, etc.), cryptographic functions executed on secret materials are usually handled on the card. The host sends the data to be encrypted or signed to the card, requests the card to process it, and then reads the encrypted results or signature. Often, there are no ways to get the chip to send the private key off of the device. Once the private key is generated or loaded onto the device, it can only be erased or written over.

Standards like FIDO and others allow for browsers and websites to utilize these cryptographic functions of smart cards in ways to handle website authentication. The technology exists for smartcards to handle authentication, it is simply a matter of us moving to this technology.