You derive a master key from a password, and use that to encrypt other keys, or a more complex key chain if needed. You then only sync encrypted keys with the server.