That’s a great question, and it is because it enables a chain of cryptographic controls that enable verification, tamper resistance, and secrecy while selling Bitlocker as computer security. It is technically secure, except that MS has your recovery keys and can give them to whoever they want.

This way, they can mathematically verify:

• Who you are and the exact unique machine you use (verification from a unique machine ID associated with your encryption keys and Windows account data)

• Know that the data has not been altered in transit (tamper resistance hash of your data)

• No one else knows except them (secret encryption keys only Microsoft controls, not you, Microsoft)

Imagine what you could do with this power for every Windows machine on the planet.