It's an open standard that allows a website to ask your browser for secure, authenticated, per-site-specific credentials. It's also a UI and method to provide those credentials and store them on your devices.

You don't have to use the latter, you can store your keys wherever you want.