When the Tor exit node executes the client's request and receives a response from the server, it must create an onion cell that can be reversely decrypted along a circuit through the Tor network. Thus, the client must be the last one to decrypt, otherwise the contents of the request can be linked back to the client's IP by the first intermediate (bridge) node, breaking anonymity. Therefore it seems the exit node would need to first encrypt the response from the target server with the public key of the client -- therefore the client will be the only one that can decrypt and get the plaintext response.
However, how can the exit node encrypt with the public key of the client? If it had this knowledge wouldn't it be able to determine the identity of the client?