Yubico's take on U2F key wrapping
The $KeyHandle$ is not the public key, it's a value used to identify the public key that's been registered.  Essentially, it's an identifier of a specific pairing of that device with that server, with its own unique private/public key pair.

From the page you linked to, the $KeyHandle$ is not a sum but both values, the nonce and the MAC of the AppID and the generated private key.  When it's registered, it sends the $KeyHandle$ and public key to the server.  

When authenticating, the server sends that $KeyHandle$ back, so the device simply uses the nonce to regenerate the private key, verifies it with the MAC, then uses that to prove it knows the private key corresponding to the public key sent during registration.

The hash is just a large number.   ECDSA is used in UAF. When using modular exponentiation systems, the public key is often of the form $g^x mod$  $N$ where x is the private key, EC is similar in form.