They created a tool that, in principle, lets a government ask about certain hash matches that are on the iPhone but not necessarily on iCloud, correct?

There is no way to determine whether the hashes are about CP or about HK protests.