Android Keystore
Android's system for storing cryptographic keys so the app can use them but never read them out.
The key is generated inside a protected environment — either a TEE within the processor or a separate StrongBox chip — and never leaves it. The app submits data to be signed or encrypted and gets the result back. Even a fully compromised app therefore cannot steal the key itself.
Keys can be bound to conditions: valid only after biometric verification, only while the screen is unlocked, or invalidated the moment the user adds a new fingerprint. Key attestation lets a server verify that the key really lives in hardware on a device that has not been rooted. The iOS equivalent is the Secure Enclave.