Keycard applet updates are done by reinstalling the applet CAP using a smartcard reader.
Keycard Shell firmware and its clear-signing database are updated separately.
For step-by-step user flows, see the help pages: