&gt; <i>An</i> encryption key<p>To spell it out (1) request <i>new</i> encryption key from device (let&#x27;s call it key4cloud); (2) encryption key generated, displayed for physical logging by the user, &amp; stored in the secure enclave; (3) all normal backups to iCloud are now encrypted via key4cloud; (4) user loses phone; (5) user purchases new phone; (6) new phone downloads data; (7) user enters key4cloud from physical notes &amp; decrypts backup<p>Yes, it requires paper and a pencil and user education (hence the opt-in). But it&#x27;s also incredibly resistant to &quot;Give us all iCloud data on User Y.&quot;