All that is true and the spin I focus on is can Microsoft have implemented it such that they have zero (ish) knowledge by default.

We know iCloud has configurations that can’t disclosed, and I wonder if there is a middle ground between if you loose the recovery key you are stuffed and maybe have a recovery key unblocked by a password similar to ssh keys