How does an application get the private key from a smart card in order to sign some data?
I presume that the data is being signed by a code running on the main OS (Windows/Linux) and not on the smart card device. am I correct?
Also, some smart cards involve PINs in the process. Does the PIN add value?
Smart cards that are used for cryptography do generate and use the asymmetric key on the device. They typically employ mechanisms to try and prevent extracting of the private key. This includes wiping the key material when a PIN has been entered wrong too many times. There has been lots of research into using cryptographic side-channel attacks to extract information by observing the smart card during crypto operations.
As for how applications interact with the smart card, every system I've worked with in the past has used a combination of OpenSC and the PKCS #11 interface it provides. PKCS #11 is the standard for interacting with cryptographic hardware devices like smart cards and HSMs.
Your premise is wrong: the key never leaves the smartcard.
Smartcard normally expose more high level functions as Encrypt/Decrypt/Sign. You pass a plaintext/cyphertext as parameter, and the smartcard hardware/internal software does the requested operation.
As an example, take a look at PKCS #11 interface.
