The U.S. Military does a passable job of this with the Common Access Card (CAC). You insert it into a smart card reader and then visit the restricted-access we

The U.S. Military does a passable job of this with the Common Access Card (CAC). You insert it into a smart card reader and then visit the restricted-access website. Your browser/OS prompts you for a PIN which, I believe, is used to decrypt your private key. Your browser validates the remote site against a set of DoD-provided root certificates that you configure on your computer before hand. Then, some kind of key exchange happens--this has always been a bit fuzzy to me--and the keys on your CAC card are used to authenticate you to the remote site. It's not perfect, of course. You can lose your CAC card and then you're screwed unless you have a way to get new one. It requires a smart card reader which is not standard on most computers. The cards themselves can get damaged by corrosive liquids or sweat (learned this the hard way). Still, it's not a bad way of authenticating and I feel much better about it than a SSH private key that hasn't been encrypted with a passphrase.