CIP-30 defines how a web page talks to a browser wallet: the dApp asks the user to enable the wallet, then can request addresses, UTxOs and signatures. The private keys never leave the wallet.
SDKs such as Mesh wrap CIP-30 so you can support many wallets with one integration. Always ask for the minimum permissions and explain to users what they are signing.