I can't comment on the legal issues of this, since I too am not a lawyer, and don't live in the US. What I can say is that your key - whether automatically gen

I can't comment on the legal issues of this, since I too am not a lawyer, and don't live in the US. What I can say is that your key - whether automatically generated or your favorite pass phrase - is known only to you, and without it all of your data is lost. Thus, if you want to you could store it at the server (so you'd never lose the data) or you'd keep it to yourself (and never risk the data being exposed).