Just for example: It could be stored encrypted with the user's credentials. So when you want to browse "Recall" it might pop-up requesting a fingerprint, password, token etc.

Then it decrypts, presents to the user, and closes the handles when you're done. In this way, the "key" isn't present -- the user has it!

That's quite a different security situation to it just sitting around in plaintext on disk. Certainly there's a number of Windows and MacOS features sitting behind authentication already, from a UX perspective.