Exactly, you ask the smartcard to decrypt your traffic (and sign data if needed), it never tells you the key, it's a blackbox - it gets plaintext input and gives you encrypted (or signed) output, without ever revealing the key it's used. It can also generate the key internally (actually a keypair, it stores the private key in secure memory (protected from software _and_ hardware attacks)) and gives you the public key so that you can publish it.
Remember, smartcards are not just storage, they are tamper resistant embedded computers. Very limited computers, true, but very good at keeping secret keys secret, both from a software attack and from a hardware (drop the card in acid, use a logic analyzer kind of) attack.
Razvan
--
Razvan Dragomirescu
Chief Technology Officer
Cayenne Graphics SRL