That is the point, the OS / container-system must provide a secure system for storing and accessing the crypted keys. In the best case your app sends (somethin

That is the point, the OS / container-system must provide a secure system for storing and accessing the crypted keys. In the best case your app sends (something like gRPC) to the OS-key-system, that adds decrypted keys and executes the function. So you app will never have direct access to the decrypted keys. Like fingerprint-system in smartphones.