I think Apple encrypts the pass keys locally on your device, then stores encrypted copies in iCloud, which you can download and decrypt on a new device.
On the new device you would be prompted for the passcode of the device you lost or broke, to decrypt and access them.
On the new device you would be prompted for the passcode of the device you lost or broke, to decrypt and access them.