Because of backward compatibility, the transaction signature generated by the card has to fit into 8 BCD digits, which essentially precludes use of any kind of public key cryptography. Actual algorithm for how signatures are generated and verified is issuer defined and only card issuer can actually verify signatures (terminal just blindly trusts whatever was returned by card).
Public key cryptography (ie. RSA) is used in EMV to verify that card was really issued by claimed issuer (card contains data structure that is signed by issuer's key) and to optionally encrypt PIN sent to card for offline verification (PIN is somehow regarded as super-sensitive by banking industry)
One can certainly imagine better design than EMV (eg. without various implicit trust relationships), but in all, it is pretty reasonable mechanism nonetheless.
Even if these keys was relevant, the important part is that they are public keys, not private keys. You cannot get card's private key from the chip by normal means (ie. without doing something that is classified as attack, be it side-channel, physical inspection or exploiting some firmware bug/backdoor).
They also require the pin code to start the process, so you would have to skim that as well.
In addition to this, in the online scenario it can interact with the payment provider's servers to provide security.
The combination of these methods make rapid stealing of EMV cards difficult.
More info here: http://www.emvco.com/download_agreement.aspx?id=653