You're trusting the client handles the key appropriately and doesn't store it or leak it in the future or worse do something malicious on purpose. Logging in with PK is handing your PK to the client. Doesn't really matter if it's securely transmitted. Use a signing extension on web (nos2x) or a signing app on mobile. (Amber)