Hrmm from what I can see. 3 keys

1 x on their server

1 x on your phone (needs to backup on Google or iCloud)

1 x on the hardware

Fully open source once available and each key has limitations.

Seems to be a good compromise between convenience, security and privacy.