content: I didn't read it completely so this may not be accurate. You have a master key. The master key is stored in the SQRL app or as an encrypted file on your phone/computer. A good implementation should allow you to move the key to a new device. Allowing unencrypted access to the master key can be dangerous so that feature is best left out. If your computer/device is compromised, then the hacker may have access to the master key (and all your accounts), but the protocol also has a key replacement ("Identity Lock") system that lets you use a rescue key ("Identity Unlock Key") that is normally stored offline (on paper, etc) to replace a compromised master key.