[provenance]

Is the Keychain DB (SQLite) stolen in encrypted form? As I understand, the Keychain DB is stored on the file system, but the DB's key is held in the Secure Enclave.