They do have a transparency report they publish twice a year. The first one for 2022 should be out soon.

https://www.apple.com/legal/transparency/us.html

They also publish one for almost if not all countries they operate in.

It’s not as detailed as Signals but does detail all government requests they get.

As far as the encryption goes, keys are generated by the devices themselves and not Apple servers.

They also detail where the keys are stored for iCloud based on what protection you choose. https://support.apple.com/en-us/HT202303

And they’re fairly transparent on all the privacy features.

I wouldn’t trust them entirely if you’re a very high risk for breach like a journalist in hostile countries, but I also wouldn’t trust any off the shelf solution for that and would be running a heavily locked down privacy focused Android fork in that case.

The cross OS compatibility is an issue though and I use Signal for anyone on Android that I talk to.