I'm going to break it down into parts, because there are four different storage mechanisms for keychain, providing four attack options to any hacker.
They will go for the weakest one, so you need to get all four right depending how sensitive your keychain contents are.
iOS Keychain Storage
iOS stores keychain data using aes, the question is how is the key generated?
My understanding is the aes key is derived by running the user's passcode or password or through a custom pbkdf2 hardware chipset, that salts the password with a bit of ROM that's unique to every device and only the pbkdf2 chipset can read it.
This ensures it is impossible to access the aes key except by providing the passcode to the actual iOS device that holds the keychain.
The pbkdf2 chipset is also deliberately slow to try and increase the strength of a four digit passcode, but it's still not really good enough and I would suggest using a password instead of a passcode if you really want to be safe.
When the screen is off (and after whatever delay you have set in settings) the aes key for keychain (and other things) is supposed to be deleted from RAM, forcing the pbkdf2 chipset to be used again to access the key. Features like bluetooth low energy and push notifications make me a bit nervous as to how strong this is, since clearly a lot can be done while the phone is locked. I haven't looked into it properly but I'm a bit concerned there might be some access to the aes key even when the phone is locked. Maybe do a full shutdown if you're worried someone might have physical access to your phone (perhaps someone can edit this section if they know more about it than I do?).
I'm not sure how touch id works, I suspect your passcode/password is encrypted using a key that is stored in the A7's "secure enclave" which is just a marketing term for ARM's equivalent of intel's trusted platform module, although arm's implementation is much newer (the A7 is the first chip to implement it AFAIK) and looks to be more robust than intel's technology.
Mac Keychain
On OS X the keychain just runs a key derivation function (probably pbkdf2 with an appropriate number of rounds) on the user's login password. You can also manually change it to be a different/stronger password.
Personally I have two keychains, my login keychain uses the login password (which is average strength) and I have a second keychain with a much stronger/painful to type password for more sensitive data. This second keychain also isn't synced via iCloud, I manually copy the file around.
iCloud
iCloud also uses aes but there are a couple of options for how the key is stored.
The description of these options does not perfectly match what it seems to actually do, they've simplified it to the point of being misleading.
With all three choices, your encrypted keychain data is stored on apple's server.
However the aes key for the data is only stored on the server if you provide a 4 digit pin or password to "lock" your iCloud Keychain. They can't be doing any fancy hardware key derivation so I think a 4 digit pin is definitely a bad idea.
Use a password, not a 4 digit pin.
I don't think there have been any official statements how the key is derived. Presumably they use pbkdf2 — that's what they use everywhere else.
You also have the option of not providing a passcode or pin. They say this means your data will not be uploaded to the cloud but what it really means is the AES key will never be uploaded to the cloud. With this option whenever you setup a new device it will need to be able to establish a peer-to-peer connection to one of your other existing devices over the internet, and they will share the AES key that way. The device will put up an alert asking for permission before sharing the key. Personally this is the option I use, since my keychain data is backed up elsewhere, so I don't mind if I loose access to iCloud Keychain.
You must also be logged into iCloud to access any keychain stored there, so the iCloud password is also required. However this is just a business policy and not involved in the encryption. Social engineering with Apple's support staff has proven effective to access someone's iCloud account and US Law requires apple provide law enforcement officials access as well. So basically I would ignore the requirement to be logged into iCloud when accessing keychain, as it's an almost useless security measure.
Your Backups
Be wary of your backup procedure. If someone can access your backup they can access your keychain, especially if you use a 4 digit pin on iOS because it cannot use the hardware key derivation (you need to be able to decrypt it without the unique ROM key on the device).
Do you use carbonite/backblaze/Dropbox/iCloud to backup your keychain? I wouldn't trust that with anything sensitive. If you use a hard drive, can it be stolen?
Final thought
Credit Cards do not really need strong encryption. Anybody could steal your wallet or take a photo of your card or skim the magnetic strip when using an ATM or store cash register or hack into your account with sony/adobe/etc. As long as you report stolen cards as soon as you're aware of it and keep an eye on your transaction history to report fraudulent transactions, all credit card theft is covered by insurance and can be reversed.
Personally I don't make online payments very often, so I don't store my credit card in keychain. But I think it's a perfectly safe place to store it. I wouldn't put my internet banking login in keychain though, since that doesn't have the same protection as a credit card.
