At least for the Yubikey option, the whole point is that the private key does not leave the HSM.