I was wondering how exactly cryptographic NFC tags/cards retain their security. I read that there are certain types of cards that are able to perform symmetric or asymmetric cryptography. These cards are said to never reveal the respective key stored inside them, obviously. The reader would provide them with a challenge, the card performs an operation on the challenge and sends it back to the reader which can verify the result with its respective key.
But how do you get the key into the card? I imagine there must be some sort of a write operation at hand, so that the issuer (not the manufacturer) can rewrite and reuse cards at will. That would mean that any third party would also be able to write to the chip, but the worst they can do is "break" it (meaning making the reader not accept the card by changing the card's key) since they can't read the key.
Is there such a write-only mechanism? If not, how else do you get the key in the card while preventing others from reading it?