I assume by using the private key to sign a message. If the card holder doesn't also hold the NFT, they can't transfer the NFT to the buyer.
My understanding is that NFTs are useful when the cost of preventing theft, forgeries, etc. is higher than the cost of protecting a private key. If "ownership" is agreed to require proof of holding the NFT as well, then it's not good enough to steal some cards from Target, you have to also steal the private key for each card, or coerce the owner to transfer the NFTs to you, etc. I guess we could think of it as a kind of two factor auth?
Proof that the person who claims to be current owner, is the person that the previous owner transferred ownership to (I guess more specifically, proof that they hold the private key). And simultaneously, proof that owner n-1 is who owner n-2 transferred ownership to, etc.
Decentralized consensus based authorization backed by the blockchain, instead of relying on some central authority to verify and enforce the validity of the contract?
At least, afaik that's the concept behind ethereum's "Smart Contracts"
(Not an NFT expert, correct me if I'm wrong please.)