[EduardoBautista]

No, that's not what it means. The key is stored on their server, but you still need to provide a password to unlock the key. In the same way that you can password protect an SSH key.

It's also the same way ProtonMail encrypts their email. They have to store the private key for you to be able to use the email on any browser.

[tgma]

This is demonstrably false: you can restore an iCloud backup on a new device without the original device password. Only with iCloud credentials which can be reset by Apple.

Only enabling ADP, disabled by default and unavailable in UK, makes it like you describe.