Hardware. There is a chip (or a SoC component) called Secure Enclave that holds the real encryption key and accepts PINs or fingerprint data and releases the ke

Hardware. There is a chip (or a SoC component) called Secure Enclave that holds the real encryption key and accepts PINs or fingerprint data and releases the key. Of course, there is the potential that Secure Enclave could be updated with new microcode (I have no idea if that is actually possible).