[thisacctforreal]

Note that on iOS, Krypt supports key generation using the Secure Enclave on the iPhone 5s (Sept 2013) and newer. In those cases it's impossible to extract the private key without finding a zero-day in the Secure Enclave coprocessor.

From "Other uses for Touch ID and Face ID" in https://www.apple.com/business/docs/iOS_Security_Guide.pdf

"App developers can do the following: [...] Generate and use ECC keys inside Secure Enclave that can be protected by Touch ID or Face ID. Operations with these keys are always performed inside the Secure Enclave once it authorizes their use."

edit: This page has more details https://krypt.co/docs/security/privacy-policy.html