However the PCC root keys are still signed by Apple which requires you to trust Apple and the laws in the jurisdiction Apple operates in.
Edit: for this update they seems to be running Gemini on Nvidia GPUs in Google's cloud[0]. How key management works for this part is unknown, but the standard setup for this is that Nvidia and Google would have keys too.
It does use the OHTTP relay[1] which makes it hard - maybe impossible - for Apple to hand over the keys for a particular person's data. Maybe that provides some additional protection in US courts against overreach.
Is this a problem for most people? Probably not - but it is something to be aware of.
I think Apple have made a great attempt to make this as safe and private as possible, but until we have a truly trustless E2E encrypted execution environment I don't see how compute offload technologies gets around this problem.
[0] > And to bring this model to production, we work with both Google and Nvidia to extend our Private Cloud Compute infrastructure to NVIDIA GPUs in Google’s cloud, while maintaining Apple’s unmatched privacy guarantees
https://9to5mac.com/2026/06/08/craig-federighi-details-apple...
It nearly works except for the annoying hardware signing keys.
With OHTTP it might still be ok because it is impossible to identify which server has your content. OHTTP probably still applies to the Apple->[Google+Nvidia] version but they haven't specifically said that.