[ImKevinArcher]

Encryption keys never leave your device, they are derivated from your password. When you use Touch/Face ID, your encryption key is stored in the Secure Enclave. In general, we use the same method/model as FileVault2.

More about Secure Enclave you can find here: https://support.apple.com/guide/security/secure-enclave-sec5...