Please consider adding the ability to add full e2e encryption, before moving things into CloudKit.
DayOne is doing this great where on first start the encryption key has to be specified (that's then stored in Keychain for those who want that). All entries are automatically encrypted before uploaded to DayOne servers, and can't get access without specifying the encryption key on a new installation
Some notes may be sensitive, and because we can't specify a custom DB location (like inside a Cryptomator vault), it would be very nice to have e2e directly baked in