So how does Find My work on icloud.com then?
Apple devices can query your AirTag's location because they sync its shared secrets through the iCloud keychain, which is used to generate temporary keys that can be use to download and decrypt the tag's location.
I see. But can't Apple simply read this data from my iCloud keychain? Or is this kind of data sharing through iCloud keychain e2e encrypted?
The tl;dr is: The information is publicly available in an encrypted form that is only readable by the party with the key.
Think of it like this, when you mark an item as lost you publish a hashed public identification key, if another device detects that key it creates a location report encrypted with your public key and posts it to a public list of encrypted reports, you decrypt the report with your private key.
Where would this private key be coming from when opening Find My on icloud.com (a website)?
If you mean from another device other than one that your keychain is on, ie, a browser on a device you haven’t logged into before, you can’t.
You can get an active location through iCloud if the device is powered on or its last location before power off if the setting is enabled. But you can’t decrypt find my location reports without the private key, which is only available in devices you’ve logged into.
You aren’t “sending” the key anywhere, you are downloading the report and decrypting it locally.
https://support.apple.com/guide/security/locating-missing-de...