Private keys that the JVM never holds: decoded by OpenSSL from native memory and kept there, handed to Java as a PrivateKey without its secret parts, and used through a JCA provider of its own. For a server's TLS key (Tomcat, Netty, any SSLContext), a client certificate, and SSH.