[stingraycharles]

Aren’t those encrypted with a key that lives on your device only?

[bri3d]

Only if you enable Advanced Data Protection, but in that case, yes, absolutely

[ants_everywhere]

how would you restore if you lost your device?

[bri3d]

Backups with Advanced Data Protection also enroll:

* Recovery Keys

* Recovery Contact (someone who holds your recovery key in key escrow)

[ants_everywhere]

right, the ability to recover implies keys exist outside the device. even if they gossip keys to other devices you control, there are lots of people with only a single apple device.