I would look at this link for details:
http://msdn.microsoft.com/en-us/library/ms345102.aspx
The short of it is that these logins are not intended to be server access logins. Rather the corresponding certificate or key is used to sign or encrypt, respectively, various objects in the database such as store procedures, and possibly data. This is used as a second level of authorization that can be temporarily granted to a connecting user or process then revoked when access to the secured object is no longer required.
Nice security feature for ensuring compliance.