With javascript in the browser, how can I sign some data without directly manipulating a private key?

With JavaScript in the browser, I need to digitally sign some data. I’m looking at the new Crypto.Subtle api, specifically the sign() and importKey() methods. I want, very reasonably I feel, to install a certificate on a mobile device, outside of my web app, then, in the web app, to sign some stuff with the installed certificate without directly manipulating or seeing the private key. However I can’t see if or how the Crypto API interfaces with installed certificates.

Am I missing something obvious? If this is not possible, are there browser plugins that can help me? I see in 2009 someone did this with an MS ActiveX object, but there must be a better way six years later?