Here's hoping they at least store the key on Secure Enclave [1]/Secure Element so it's inaccessible to the operating system in case of a breach.
[1] https://developer.apple.com/documentation/security/certifica...
[1] https://developer.apple.com/documentation/security/certifica...
The whole point of a smart card (same as a military CAC, and almost the same as a TPM chip on computers) is to sign operations using the private key, without allowing export of that private key. They're still made of atoms, like all objects, and susceptible to physical key extraction attacks.