Does encrypted at rest necessarily preclude Google from retaining keys? It seems like the same schtick Apple had for all these years where they said iCloud data was fully encrypted (which was true) in the hopes everyone would conflate "encrypted" (you and them have the keys) and e2ee (where they don't handle the keys).