Some interesting thoughts here, but the issue of the key leaking is still a problem with your proposed protocol. After the first time all these trusted parties

Some interesting thoughts here, but the issue of the key leaking is still a problem with your proposed protocol. After the first time all these trusted parties come together and reveal the key, someone still has to actually take the key and decrypt the relevant message. After that point, the key exists in plaintext, and it will be very difficult to ensure that it remains secret. Same problem with giving the key only to an AI: The AI needs the key, and it will be difficult to ensure that the AI system isn't hacked, especially if it's the kind of large distributed system that would be required to process everyone's messages. What you're looking for is a protocol where N parties have to agree in order to decrypt any given message, and agreement to decrypt a particular message doesn't allow them to decrypt any other messages. Here's one that might accomplish that (disclaimer: I am not a cryptographer): - People can use whatever end to end encryption scheme they like to send their messages, but they must Shamir-split the key into N parts, and send those parts to the relevant authorities. - We can check that people are obeying this protocol without violating their privacy by the following method: Every time someone sends a message, they xor it with a string of random bits. Then they send it in 2 parts: the xored message, and the original string of random bits. The original message can only be reconstructed from both parts. Each part is sent with a separate key. The N authorities randomly choose one of the two parts to open. They then check that it decrypts properly (messages will include a hash of the contents, so that this is easily checkable, and difficult to fake). - Of course, people may not trust the authorities to only decrypt one of their message pair. The solution to this is that the list of N authorities is always the same, except for the last one: this is a choice server. People can use whatever choice server they like. However, all choice servers are required to be auditable by both the government and the public. It's the choice server's job to (1) randomly choose 1 message from each pair to decrypt, (2) not release the Shamir-fragment for the key to the other message unless given a warrant by a judge. Of course, this will be inconvenient, imperfect, and add a heck of a lot of overhead. Some choice servers will be found to be corrupt either in favour of the intelligence agencies, or the criminals, having managed to hide their corruptness from audits. It also will not stop determined criminals from using their own encryption. It's not all that easy to tell when people are sending encrypted messages to each other, the messages will just look like random bits. There are plenty of places in perfectly innocuous seeming messages to hide random bits. They could even be hidden as noise added to a particular image. A random-bit-hiding arms race is one that cipher-users are inevitably going to win.