You can ask the Secure Enclave or a smart card to perform operations using a key pair which is generated on and never leaves the device. In the case of SSH, you can use that directly as long as your SSH client and server support that algorithm: the client advertises the key fingerprint and just passes the server’s challenge through without modification. Apple has had native support built-in for using PIV/CAC tokens for years.

For storing arbitrary sized things, you’d typically use that key pair to sign an AES key used to encrypt the actual file so your device only needs to store the comparatively small keys.