No, you're right: Checkm8 only lets you boot into a custom OS, but to decrypt any data from the installed iOS, you'd need to hack the secure enclave, which it d

No, you're right: Checkm8 only lets you boot into a custom OS, but to decrypt any data from the installed iOS, you'd need to hack the secure enclave, which it doesn't touch. (Technically you could boot a fake OS with a passcode skimmer, but developing this into an actual exploit isn't any easier than simply observing the user entering their passcode.)