The app I'm working on
creates a single zone (e.g. CKRecordZone(zoneName: "Documents") in the private database
syncs documents as CKRecord to that zone, which have some fields set via encryptedValues[…]
When launching the app after clearing local caches, the app fetches all zones and fetches all records from the "Documents" zone if it exists already.
in my understanding, the data in CloudKit is encrypted with a key that should be resettable in some way and then would become unreachable afterwards
My setup
I tried this with a debug build (icloud development env) and a testflight release (icloud production env) on a separate user on my mac, which was logged in to its own iCloud account.
What did I try?
I closed my app, cleared its caches and then
ran "Reset Default Keychains…" in the Settings of the Keychain Access app to attempt resetting encrypted data.
I relaunched my app
Expected result
I expected the "Documents" zone to be gone, and no documents to reappear, technically expecting zoneNotFound+ CKErrorUserDidResetEncryptedDataKey
Actual result
All documents were redownloaded from the "Documents" zone. This means the zone still existed with all data accessible.
Also, the data was still there when I checked in the CloudKit Console (development and production environment)
I had a look at Delete a keychain in Keychain Access on Mac but I think it doesn't apply because "Delete Keychain iCloud…" is greyed out.