[Spivak]

> but Apple seems to have access to the encryption keys

Of course, no one claimed that iCould data was E2E. They also need to decrypt the data in order to serve it to their users.

[DavideNL]

> They also need to decrypt the data in order to serve it to their users.

That's the point, they don't (and shouldn't) need to. As Apple itself says in the above linked article:

"Apple is working to further harden iCloud security so that even it won't be able to access user information stored on its data servers"

[crooked-v]

Web access means that you've always got one of three things:

1) the company has the encryption key

2) you give the company the encryption key each time you log in and they store it temporarily

3) everything is getting decrypted in the browser locally (probably tremendously infeasible)

[derefr]

#3 is how Mega works.