At least for the Yubikey option, the whole point is that the private key does not leave the HSM.

> This is all, frankly, nonsense.

Only because you clearly don't understand how it works. What's interesting is that you seem to understand half of it... or maybe you don't, and you just repeat stuff you don't understand either?

> If you're using userspace software to decrypt the keys into memory

That's exactly why you don't do it. A Yubikey or a secure enclave create the private key and emit the public key.