I mean, we're moving goalposts here from "guarantees that SEP makes" to "guarantees that iCloud Keychain makes". You're right that the items from iCloud Keycha

I mean, we're moving goalposts here from "guarantees that SEP makes" to "guarantees that iCloud Keychain makes". You're right that the items from iCloud Keychain don't just sit in a plaintext on a disk, and that the ceremony to join a keyring is a complex and (until proven otherwise) secure one, but none of that is related in anyway to SEP. The very existence of iCloud Passwords extension for Chrome on Windows should be a proof of that.