Imagine a marble rolling down an inclined valley. The walls of the valley keep the marble in one defined track.
Now imagine a marble rolling down an inclined ridge. In order to stay on the top of the ridge, the marble has to move in *exactly* the right direction. Even a little bit off, and it will roll down the side of the ridge and not stay on top.
That's a little bit like a gravitational keyhole. Apophis is absolutely going to miss the Earth in 2029. But the approach is going to be so darn close that Earth's gravity is going to change its orbit pretty severely. But -- and this is the key -- *exactly* how much the Earth changes the orbit of Apophis is dependent on *exactly* how close Apophis gets. And we've got a pretty good idea, but not that good. So we won't know for sure until the asteroid has already passed us and we can compute its new orbit.
The "keyhole" comes from the fact that there is region of space near Earth that, if Apophis passes through that region, Earth's gravity will change its orbit in such a way that Earth will collide with the asteroid in 2036. (It's called a keyhole because it's a very small region of space.) We now are pretty confident that Apophis will miss the keyhole in 2029, and therefore miss the Earth in 2036.