There is a public append-only merkle-tree with all identities published in it in an analogous way to certificate transparency. When you add a friend you are looking them up in this tree and then storing their public key chain in your own (private) storage in a tofu manner (then any key changes they make are verified against your local copy).

You can also verify keys in person using the same protocol as Signal (via QR codes or number groups).

There are no private keys stored on any devices, so adding devices is not a thing. It is a pure capability based system.

Unlike keybase, we are fully open source and self-hostable.

There are a lot more details in our booklet- https://book.peergos.org