Credentials and their keys stay in this browser, in IndexedDB. Each credential gets its own non-extractable P-256 key, so the browser can sign with it but no script can read it out.