The U.S. Military does a passable job of this with the Common Access Card (CAC).  You insert it into a smart card reader and then visit the restricted-access website.  Your browser&#x2F;OS prompts you for a PIN which, I believe, is used to decrypt your private key.  Your browser validates the remote site against a set of DoD-provided root certificates that you configure on your computer before hand.  Then, some kind of key exchange happens--this has always been a bit fuzzy to me--and the keys on your CAC card are used to authenticate you to the remote site.<p>It&#x27;s not perfect, of course.  You can lose your CAC card and then you&#x27;re screwed unless you have a way to get new one.  It requires a smart card reader which is not standard on most computers.  The cards themselves can get damaged by corrosive liquids or sweat (learned this the hard way).  Still, it&#x27;s not a bad way of authenticating and I feel much better about it than a SSH private key that hasn&#x27;t been encrypted with a passphrase.