The white paper goes into some detail on the encryption and key exchange mechanisms. Basically devices exchange public keys so their private keys never have to (and physically can’t) leave the SEP.

Backups are different. Those are not encrypted with device keys because obviously you want to recover from loss of device and restore to a brand new one. But if you’re not comfortable with that, you can do local encrypted backups with your own password via iTunes. And as noted the most sensitive data like HealthKit is only included in encrypted backups. White paper also discusses a special escrow service for backing up your keychain, incidentally.