It doesn&#x27;t even need the hardware part in most cases. OS keyrings support pkcs11 interface with signing exposed. That means you can just send data to be encrypted for example by gnome-keyring and the browser never sees the actual key.