Good to know, hence my 95% certainty. Fortunately for me, each new device starts with DFU restore and installation of my own Configuration Profile which supervises the device, disable automatic pairing with new devices, disables useless apps like Game Center, and most importantly disables iCloud Backup entirely, etc.

How do you make backups of your data; e.g. Photos, Notes and Messages?

You could always sync and backup (make sure it has a password so that keychain data is stored in the backup) your iPhone to your Mac since the dawn of iPhone OS. You can still use iCloud sync for contacts and notes if you choose to for convenience, but I absolutely do not want iCloud backup.

How are you achieving this? I’d like to know more. Thanks in advance.

Perhaps I should document it and link to it in detail but basically you use Apple Configurator to create a profile and set its restriction flags accordingly and keep it somewhere you can redeploy with ease and simply DFU restore the iOS device so that it gets the latest clean iOS image. After that you don’t activate it by going through the setup screen. Instead you use the connected Mac with Apple Configurator to “Prepare” the device and the computer activates it and pairs it with your “organization” public key and you can add the profiles you created in the previous steps to apply the configuration restrictions. It’s like having an enterprise MDM except you don’t need a server just the local profile is enough.

> Perhaps I should document it and link to it in detail

Would be very interested in this.

Feel free to send me a note to the email in the profile. I will make sure to link to you when I get to documenting this.

Yes please, document this, this sounds great!

No, that's not what it means. The key is stored on their server, but you still need to provide a password to unlock the key. In the same way that you can password protect an SSH key.

It's also the same way ProtonMail encrypts their email. They have to store the private key for you to be able to use the email on any browser.

This is demonstrably false: you can restore an iCloud backup on a new device without the original device password. Only with iCloud credentials which can be reset by Apple.

Only enabling ADP, disabled by default and unavailable in UK, makes it like you describe.