And uses the secure storage built by phone providers

I‘d assume on device keys would help make it little overhead if the end user device is the decryptor