keys are generated offline in a one way process. you can for example install Electrum on a PC without internet and create a whole set of new keys. An address generated offline is then unknown to the blockchain until you transact with it. This also means that you can sign a transaction on an offline device to then broadcast it from an online device. The tx is already signed and cannot be tampered with.