On the other hand, for the average person already using unencrypted iCloud backups, it is a considerable step forwards, and arguably managing their own high-entropy recovery key could be a significant burden.

I just really wish they'd made PIN-based HSM escrow the default, but optional (with the "off" switch behind several scary-sounding warnings).