I'm trying to understand where the private keys are stored in the Persona system, and how they are protected.
Can anyone elaborate on where the crypto material is created, stored, and what is transferred?
Tom is right that once browsers have native support for Persona, they will be able to store keys in their keystore.
The keys themselves are created client-side in the browser but making use of entropy coming from the
navigator.id. So it is up to the browser to generate key pairs, and store them "as best as it can". Documentation is scarce, but it seems plausible that browsers use the same facilities as what they use for X.509 certificates, i.e. libnss for Firefox, and the cryptographic providers of the operating system Internet Explorer and Chrome. Private keys never escape the clutches of the browser (only public keys will travel to other machines).