I have not heard of this key handle before - is there any docs on it?

Oh wait, example.com sends me a encrypted key, that I decrypt and then use? That sounds ... odd.

I mean, why not just keep the same encrypted data on my local phone ? The attack surface seems much smaller.