Your private keys are encrypted locally on your device with Secure Enclave, protected by Biometric and 2-Factor Authentication.