Preferred

Use secure hardware when available, falling back silently to the default storage otherwise.

On Android, StrongBox is used when the device supports it (API 28+); otherwise the default TEE-backed Keystore is used. On Apple platforms, the Secure Enclave is used when the algorithm supports it (ES256/P-256 only); all other algorithms fall back to the standard Keychain silently.