> If you hook a device up to a cloud account, you should expect the identifiers for that device to come with it. I think nobody would object to Apple storing m

> If you hook a device up to a cloud account, you should expect the identifiers for that device to come with it. I think nobody would object to Apple storing metadata like "devices UUID1, UUID2, UUID3 have access to user ID1's keychain", but Apple storing the domain and credential ID of Passkeys (if that's what TFA actually found [1]) would go a bit beyond that in my view. [1] There's a chance that these are passkeys for Apple, not stored with Apple. Every relying party needs to store the public key and credentialID server-side in order to facilitate future authentications. We'll see if that is the case in a bit – I requested a copy of my Apple ID data, and I have non-apple.com passkeys on my account, so if I can see the domain for these in plaintext, Apple is indeed storing that metadata unencrypted.