If they can decrypt the data if you lose the device, it by definition do not require an on-device only key. That is, Apple do have the key outside the device.