Right, it's obviously end-to-end encrypted because if it weren't, everyone would have been screaming for years about how horrendously insecure it was.

iCloud Keychain is fine, just use a good password. There's no particular harm in letting Apple store an encrypted blob for you on its servers.

And only enabled if 2FA is enabled. It won't work without (as won't many Apple services).