Yes, thanks. Actually, that's the main documentation I was looking at before. I can't figure out from those descriptions how Apple IDs and iCloud keys work, and in particular, whether Apple themselves hold all of the necessary credentials to decrypt data held in iCloud services or whether something remains with the user alone.