Hacker News Reader

The only difference is Apple doesn't hold the encryption keys when you use ADP.

In both cases it's encrypted in transit and at rest.

TIL that Apple holds the keys to my iCloud encrypted data!

For most of it, yes. There are exceptions, e.g., Health and Keychain, for which Apple does not have the keys even without ADP enabled.

Yes, otherwise, how would the web interface (iCloud.com) work?

Or account recovery