> All of them will leak? Seems like if each key is in possession of a different party, and you need all keys to decrypt, and at least a few are air-gapped only

> All of them will leak? Seems like if each key is in possession of a different party, and you need all keys to decrypt, and at least a few are air-gapped only available for warrant holders via manual retrieval... the probability would be vanishingly small. There are always tons of assumptions we make when we say these things. We assume that the computer used to generate the keys was never connected to the internet, has not already been compromised at the time of key (re)generation, there are no backups of the computer, the engineer that performs the key generation is extremely trustworthy, the room this is done in is perfectly isolated from surveillance, etc. If you start calculating these probabilities and multiply them together, you start observing them moving further and further from 100%. > but in reality nobody has put out significant resources and made an honest effort to try These just seem like No True Scotsman fallacies. If anyone comes up with evidence of an effort, are you going to move your goalposts? IMHO, the incentives don't exist. Law enforcement can't even secure their own technology and vendors (eg. BlueLeaks, OPM hack). The tech companies tasked with this project only see it as a cost center and see it as a potential massive risk to their brand if this system is misused. During the Snowden leaks, there were accusations of NSA contractors using the search system to spy on family members, dating partners, etc. Human behavior is too predictable to naïvely assume that we can increase security while increasing the number of keys/people who have access to a massive tranche of data.