I thought WebCrypto let you make non-extractable keys.<p>But in any case, I&#x27;m not sure I understand the threat model of that. The &lt;keygen&gt; service will already sign any public key that gets to it past authentication, so if you&#x27;re worried about client attacks, that&#x27;s <i>already</i> a problem. There&#x27;s no distinction between compromising an existing private key and getting a new, unauthorized private key signed. You&#x27;re <i>already</i> requiring that the site be secure against these attacks.<p>Obviously you don&#x27;t store this in storage accessible to every relying website; you just store it in the origin of the authentication service itself, and have it generate signed messages (either client-side or server-side) that get passed to the relying websites.