iCloud Keychain is end-to-end encrypted among all your devices and uses iCloud just for syncing your password and other shared keychain entries. As I’ve written previously in “Why iCloud Keychain may prompt you for a device password used with other Apple hardware you own,” Apple relies on device passcodes in a special way as you add additional devices to an iCloud Keychain set.
With your first device, you’re simply enabling syncing. Apple requires that you enter the password or passcode on that device to prime the pump. That encrypted password is used to wrap all your iCloud Keychain entries. The next device you add will prompt you to enter the passcode or password of the one you initiated iCloud Keychain with. Entering the secret unlocks the iCloud Keychain sync and adds your new device to the set of legitimate keychain sync partners. Because you’re entering the passcode or passphrase on a device under your control, it’s never leaving your hardware: Apple doesn’t learn it; it’s just a secret only you know to unlock the syncing operation.
Read more at Macworld.com