TPM

You never have the private key, only the ability to ask something to encrypt/sign something