Well if the alternative is the current situation where Apple has access anyway, a key that Apple may know is still a better idea.

For even better security they can instead provide an NFC smartcard or hybrid NFC + USB (like a Yubikey) where the key is stored in hardware and can't be extracted.