PKI tokens (USB) securely store private keys, which are used for digital signatures and decryption, and public keys, which are used for encryption and verification.