AFAIK, there are two kinds of private keys here. There's one key used to encrypt the backups, which can be either local (on the device) or sent to Google's or A

AFAIK, there are two kinds of private keys here. There's one key used to encrypt the backups, which can be either local (on the device) or sent to Google's or Apple's servers; that key is AFAIK kept by Facebook (unlike Signal which asks you to write it down), but it's useless without the backup files, which most probably Facebook cannot access directly. The other key is the ratcheting end-to-end encryption key, and AFAIK that's only kept by the device itself; if you have the right option enabled, you can see whenever someone you're talking to installs WhatsApp or Signal on a new device, since you'll be warned that the key has changed.