It's almost certainly correct that they use the Keychain for Touch ID. But I'd hedge that if they were bent on being insecure, they could use a different Touch ID mode that just returns a boolean. Does anyone know whether app review examines which mode they choose?