The backups are unencrypted as highlighted in the UI (if I recall correctly). They re-generate the keys when you switch phones / re-install / clear data. That's when you get to see the "XYZ's security code changed" service message