Encryption
Encryption transforms readable data into a form that is meaningless without the corresponding key. It is what makes a stolen database or a lost device a nuisance rather than a disaster - provided the key is somewhere the attacker is not.
Two kinds appear throughout this documentation, and the difference matters:
Symmetric encryption uses the same key to lock and unlock. It is what protects a password vault, and what encrypts a device-to-device backup once the two Seedkeepers have agreed on a shared key at pairing. Fast and simple, but both sides hold something worth stealing.
Asymmetric encryption uses a key pair: what one key locks, only the other can unlock. This is what a passkey relies on - your device keeps the private key, the service holds only the public one, and nothing worth stealing is ever transmitted. See How Passkeys Work.
On a Seedkeeper, keys are generated and used inside the secure element, which has no function for reading them back out. Encryption is only as strong as the protection around the key, which is the entire argument for putting it in hardware.