How do the Keychain and Data Protection classes work?
Essence
iOS encrypts data on disk in hardware, with keys tied to the device and the user's passcode. An app takes part through two mechanisms: Data Protection for files and the Keychain for small secrets (tokens, passwords, keys). Both let you choose when data is available: only while unlocked, after the first unlock since boot, or always.
The rest of this answer, with code and interview follow-ups, is in the DevPrep app.
Read the full answer in DevPrep