Corrupted iCloud Keychain - Secure Notes Removed

I have encountered two separate but related issues.

1)

Corrupted Keychain

I recently updated to Sonoma 14.1.1. as it was a point update, I was not paying a whole lot of attention. After the update was completed there was no obvious sign of a problem. I don't recall an iCloud reauthentication request soon after the update. I continued using my Mac for some time. I then shut down the Mac.

It was not until the next morning when I started the Mac that I was prompted to reauthenticate with iCloud.

Once I provided my login details, my Mac seemed fine generally, with one exception... The iCloud Keychain seems to have been corrupted somehow.

My regular passwords stored via Safari are fine as far as I can tell. However, the over 100 "Secure Notes" are mostly gone. I find these symptoms very odd, it to be entirely empty... not to show a few items . For those not familiar, Secure Notes are viewable and editable via the Secure Notes tab on the Keychain Access app for MacOS.

I was hoping it was a local issue, so after much back and forth with Apple Support, I signed out and then back into iCloud. The problem persisted. It seems like the "bad" version of the data had also made it's way to iCloud. This is a big problem for me as I intentionally did not store certain passwords in the keychain accessible via Safari (security reasons). Instead I stored these records only within the secured notes...

Apple support claim that the iCloud service has no ability for them to recover any kind of point-in-time backup (even for small files like keychain).

I am assuming that this experience of an corrupted iCloud caused by an update is rare, or maybe just not enough people have reported it yet if it is 14.1.1 specific.

This leads me to the second problem...

2)

An accessible Time Machine Backup of an iCloud synced Keychain does not seem possible

Disclaimer: Due to the frankly disappointing lack of knowledge from Apple Support staff I spoke to about this issue, I cannot confidently state that the following is true... but it seems like this problem is a design problem or lack of relevant features, not a bug.

If you click the "Passwords and Keychain" checkbox found in System Settings > iCloud, your Keychain becomes synced to the iCloud. There is also some kind of local copy, as Keychain data remains accessible even with the internet inactive (I can view a secure note for example). Perhaps this local copy is the item that got corrupted and subsequently synced.

If you then attempt to create a Time Machine Backup of your Mac, it seems that Time Machine does not store files to the backup in a way that the user can then restore the Keychain in MacOS to an earlier point in time (to fix a corruption problem for example).

With the guidance of Level 2 Apple Support (via screen sharing), I deactivated iCloud Sync before attempting to perform a restore of the Keychain files that were present on Time Machine backup – but was unable to import the files into the Keychain Access app. All Keychain files were greyed out / not selectable when I attempted to import into Keychain Access.

The assumption seems to be "if it is stored in iCloud it is immune to any problems".

Maybe a restore might work if you were restoring an entire system to the same device, but certainly not by attempting to use the individual files. If like me, you have not performed a Time Machine backup for a while and only want to restore the Keychain File (like you would any other kind of file) that's a problem.

If true this is a potential danger to anyone who expects to be able to restore an iCloud synced keychain. If I had known this, I would probably have been using 1Password for the last several years.

To make matters worse – I believe that this is also a known issue – as the Apple Support staff referred to an internal document that essentially says "you can't restore".

I would like to know how many other people have encountered this issue... if I am wrong, I would love to hear from Apple (or even other community members) how this is possible to do. After 4 calls and a visit to the apple store later, my conclusion is that this is not possible generally (not just in my specific case).