True, you only need your password to issue a new key set to the keybag; you can actually monitor the protocol for devices that are distributed your decryption k

True, you only need your password to issue a new key set to the keybag; you can actually monitor the protocol for devices that are distributed your decryption keys (including Apple if they were spying) and you get a popup on each device alerting you to this. It is possible Apple could create a back door for them to issue a certificate set to your keybag without your permission but that would be a can of worms for them, I'm actually comforted by the fact that they'd much prefer to keep end-to-end encryption for their own liability.