They are not lying when they say that they cannot read your messages at rest or in transit without actively changing the code so that you start trusting a new key. The keys sync between devices in ways that Apple cannot read.

This is not bulletproof, because they can potentially change the code to do this - this is what the FBI vs Apple thing was a few years ago was all about.