So you manage your own encryption keys for cloud files? Thats pretty much the only way and even then you have to trust Apple because it’s closed source.

They have full control over your device. It’s the same for Whatsapps encryption, where Facebook can still access everything on your decrypted client.