Q: Which key is used for iCloud backup encryption?

Hi,

following the article https://support.apple.com/en-us/HT202303 iCloud will use a 128bit AES key to encrypt the backups on the server. However, I would like to know whether it is the user device or Apple who generates and keeps this key (maybe derived from passcode, Touch ID or whatever)?

Is it possible for Apple to decrypt my backups?

Thanks and best regards

Thomas