You don't actually send your private key to the server during authentication, the server asks you to sign a random value with your private key, which never leav

You don't actually send your private key to the server during authentication, the server asks you to sign a random value with your private key, which never leaves the safety of your computer. If this value can be restored using the public key, then you are authenticated. Since the private key never left your computer, it is impossible to compromise the private key on the server side.