Generate a challenge, sign a PSBT that commits it (OP_RETURN), and verify. No private keys ever leave your wallet.