[p_l]

The stories about Apple keeping things secret usually go about protecting their business secrets from normal people, up to doing probably illegal actions.

Using deniable, one-time keys etc. are... not that unusual. In fact I'd say I'm more worried about the use of random USB keys there instead of proper KMS system.

(There are similar stories with how doing a cold start can be difficult when you end up with a loop in your access controls, from Google, where a fortunately simulated cold-start showed that they couldn't access necessary KMS physically to bootstrap the system... because access controls depended, after many layers, on the system to be cold-started).

[milkshakes]

they used smartcards, not usb keys

[p_l]

Which probably were just key transport devices from offline secured KMSes