In a PKI, nonrepudiation is achieved by using digital signatures, which are created using the sender's private key. The certificate issued by a certificate authority (CA) binds the public key to the individual or entity, ensuring the identity of the signer. This way, the sender cannot deny having signed the message, as only their private key could have generated the corresponding signature.
While private keys, enterprise key management systems, and specific cryptographic algorithms like elliptical curve cryptography are part of the broader security ecosystem, the primary mechanism for nonrepudiation in PKI is through digital signatures supported by certificates issued by a trusted CA.