Clarification about private keys for passkeys

Hey there,

I was doing some reading about passkeys and 1Password and started wondering: does 1Password ever actually store passkey private keys on the device's TPM or Secure Enclave? Or does it only use the cloud-based vault and sync the private keys to the current device as needed, using some local storage as a cache such as Indexed DB (encrypted)?

This is within the example context of using the 1Password Chrome extension on a MacBook without the desktop app installed.

Reason I'm confused is that some cloud-sync passkey providers such as Apple seem to do both the 1) device-bound Secure Enclave storage AND 2) 'cloud vault' equivalent to sync across devices.

I'm only confused because in some 1Password docs/threads I've seen people say that the private key is stored on device while in others I've seen the opposite said.

Also, is there a difference in the way the private key is handled if you are just using the extension vs extension + desktop app?

Thanks so much for your time