This is incomplete. But hopefully of some use.
http://imfreedom.org/wiki/IMessage and https://github.com/meeee/pushproxy (especially the docs section) have done some reverse engineering of apple's proprietary protocol.
Seems that every apple device has a SSL/TLS client-side cert for authentication that setup to be known to apple's push server. This is used to authenticate you as well encrypt the connection between your apple device and apple's push server. I do not see anything about retrieving public keys of users you are sending messages to; hence your message is completely readable/editable by someone at apple's servers.
To specifically answer the three questions:
- What security technologies and protocols are used?
Standard SSL/TLS certificates. Apple's self-signed certificate uses RSA 2048-bit public key.
- How are the messages encrypted?
SSL/TLS to encrypt the connection between the apple push server and your device.
- Is it truly end-to-end secure? Can Apple or anyone else circumvent the encryption?
Yes. To the best of my knowledge messages are in plaintext on apple's servers.