Earlier quoted context omitted.
"unextractable" from the perspective of the JS-facing APIs does not necessarily mean unextractable by local malware (unless it's backed by something like a TPM!)
Most session hijacking is via JavaScript, so even malware-extractable browser-TPM would help a lot!
You can use js-nonextractable keys for auth today, no new specs needed.