Stored in an authenticator/credential manager in general, not specific to a security key, secure enclave, or TPM.