The main threat model here is a stolen/lost device or an unscrupulous repair shop not a government agency with a warrant.

You also do not have to backup keys in the cloud, however for most users it’s the best solution since for them data recovery in case of a hardware failure is more important than resiliency against state level adversaries.