You were sort of both right. Apple has the keys in escrow across several HSMs separate from the cloud hosting environment. Nothing within iCloud can actually s

You were sort of both right. Apple has the keys in escrow across several HSMs separate from the cloud hosting environment. Nothing within iCloud can actually see the content, but there are processes to get access to a particular account for various reasons (such as government order). There is a separation of permissions as well as hardware-generated audit logs. Reportedly the HSM systems were specifically manipulated to not be extensible via software updates. So it is E2E with a separate key escrow system, which Apple (wisely) does not attempt to call E2E. Apple couldn't implement the PhotoDNA-based scanning other providers have done because Apple would need access to the escrowed keys for each user photo uploaded.