No they do not have copies of every Bitlocker key.

Bitlocker by default creates a 48-bit recovery code that can be used to unlock an encrypted drive. If you run Windows with a personal Microsoft account it offers to backup that code into your Microsoft account in case your system needs recovered. The FBI submitted a supoena to request the code for a person’s encrypted drive. Microsoft provided it, as required by law.

Bitlocker does not require that key be created, and you don’t have to save it to Microsoft’s cloud.

This is just a case of people not knowing how things work and getting surprised when the data they save in someone else’s computer is accessed using the legal processes.

Normal setup for IPv6 is to use public IPs everywhere, and use the firewall to block traffic to your internal systems.

https://desantolo.com/2021/02/ipv6-lan-network-address-translation-nat-on-opnsense/

This article has instructions for configuring NAT6 outbound in OPNSense. It makes the IPv6 work similar to IPv4. Local DHCP routed through single external IPv6 address.