An optional remotely attestable secure enclave all secrets are encrypted to on first entry can however bulk encrypt secrets to a public key of each device bypassing the touch policy when adding new devices but still requiring a manual tap for each secret on each device if consent challenges on all involved devices and optional time delay policies are met.
I’m really not sure what you’re trying to say? You have some magic device that can tell when you want you reencrypt everything for new devices versus just accessing your passwords? This doesn’t exist.