> The private key never leaves the enclave.

..

> While Secretive uses the Secure Enclave for key storage, it still relies on Keychain APIs to access them. Keychain restricts reads of keys to the app (and specifically, the bundle ID) that created them.

Doesn't that mean the keys leave the enclave?

The Keychain API is how you interface with the enclave key functions. It's just saying theres separate permissions for using the generated key.

https://developer.apple.com/documentation/security/certifica...

"When you store a private key in the Secure Enclave, you never actually handle the key, making it difficult for the key to become compromised. Instead, you instruct the Secure Enclave to create the key, securely store it, and perform operations with it. You receive only the output of these operations, such as encrypted data or a cryptographic signature verification outcome."

I think they meant to say "use" not "read".

Awesome, thank you.