I agree that this is better than no encryption. And they're likely escrowing (in most but not all cases) the key for valid UX reasons. The tricky part is doing

I agree that this is better than no encryption. And they're likely escrowing (in most but not all cases) the key for valid UX reasons. The tricky part is doing it without asking the user. Apple used to do optional escrowing on OS X with File Vault 2, but they asked the user. The privacy/surveillance concern comes to play now that China has a law (as of Sunday) saying that tech companies need to be able to hand over keys on demand/request (whatever). Since Microsoft escrows them, they'd be capable of complying. Google and Apple who don't escrow them at all anymore, can't actually comply. Uncertain is whether the law requires them to start a key escrow function. EDIT: And then what if/when U.K. wants access on demand to that escrow service? And then what if/when the U.S. does? If the companies have the keys, it doesn't require a law to get access to them, just a subpoena. It'd require a law to compel the companies to create the escrow capability though.