I'm pretty sure that is how non-resident keys work on some platforms (like the first gen yubico U2F tokens).
The main feature of resident (aka discoverable) keys is that the RP doesn't need to know anything about which key is about to be used, so it can just say "send me an auth for example.com", and the browser and key handle the rest.
However, with non-discoverable keys, the RP has to provide a reference to the key, which could actually have encrypted private key matter in it.
The main feature of resident (aka discoverable) keys is that the RP doesn't need to know anything about which key is about to be used, so it can just say "send me an auth for example.com", and the browser and key handle the rest.
However, with non-discoverable keys, the RP has to provide a reference to the key, which could actually have encrypted private key matter in it.