From the link: "On device revoke, the revoking device makes a new master key, encrypts for the private key for all remaining devices, and writes the new master key to the sigchain along with the statement revoking the old device."
Exactly. Sorry for the doc bug there. s/master key/PUK/g, now fixed on the site. An earlier internal name for PUKs was "master keys" but we've since changed.