Each end device you use to connect to your Matrix account creates own keys per default, but you can also import/export keys if you want to. Then other parties can enable or disable trust for each key. For browser based clients like riot, I think each session creates another key.
Docs (the first link is most relevant to your question):
I really like the work matrix did. But the UI for having just an e2e encrypted chat with someone you can't physically authenticate keys with on a simple not so important chat is so annoying and confusing. As I understand it they're redesigning it. But as it stands for a normal end user the UI is broken if you ask me.
Personally I liked the flow of knowing a shared secret to a private channel back when people were doing blowfish in IRC was way better than this exponential key exchange thing.
Sure it's not as secure, but at least it's somehow humanly feasible.
Yeah, I wasn't talking about the crappy old UX that you & the grand-parent are referring to, but the redesign which is on the horizon in the coming days (https://news.ycombinator.com/item?id=22856867) :)
Docs (the first link is most relevant to your question):
https://github.com/matrix-org/matrix-doc/blob/master/specifi...
https://matrix.org/docs/guides/end-to-end-encryption-impleme...
https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/ol...
https://gitlab.matrix.org/matrix-org/olm/blob/master/docs/me...