What do HSMs have to do with anything? Using HSMs doesn’t make it harder for a provider to decrypt your data, they can just ask the HSM they control to decrypt

What do HSMs have to do with anything? Using HSMs doesn’t make it harder for a provider to decrypt your data, they can just ask the HSM they control to decrypt your data whenever they want. HSMs exist to make it harder for outsiders to exfiltrate keys, not make it harder for insiders to decrypt stuff. I can’t speak for China. But outside of China iCloud E2E uses keys that are only stored on customer devices. I.e. your iPhone is the HSM. In theory iCloud needs zero crypto capabilities server side, because all the crypto happens client side, and servers are just moving opaque encrypted blobs around.