Author of the blogpost here: Firstly didnt expect anyone would read my blog post (Atleast not this soon) let alone someone posting a link on hackernews. Yeah I realized while i was writing that if somehow that (my assumption about master key) did happen then it would be bad press and completely destroy Apples reputation for a privacy first. At the same time for an usecase like mine where i want my work isolated from personal it is weird that without proper way to get the data back they would allow this to happen. I mean if i really didnt remember my password then my keychain data would have been gone without which lot of work related info would have been hard to recover.