Not all that rare (see: OPM leak, any of the other leaks that happen daily) especially with such an incredibly high value target. If it's a symmetric key style system, then wouldn't all previously encrypted communications be vulnerable if they've been recorded someplace? Email, ecommerce, server logs, everything.

Leaks in general aren't rare. Leaks of high value private keys are very rare.

Offhand the only ones I remember are D-Link's leak of a code signing key this year and AMI's leak of a BIOS signing key a couple years ago. I've probably forgotten some.

Keys of this value are generally not stored online, and are often split using a secret sharing system among several people.

It's not hard to set up a system where all of the decryption of the encrypted symmetrical keys of seized phones takes place on a computer that has no network connection and no interface to the outside world other than CD-RW discs [1].

Of course just because there are ways to manage the private key and its use in such system that are arbitrarily safe that doesn't mean that the FBI would actually handle their key properly. If they do lose control of it, it would be bad.

My point, though, was just to illustrate that it is not the case that providing warrant access requires putting in a backdoor that completely opens up the system to anyone who knows about the backdoor and then hoping to keep knowledge of the backdoor hidden.

Also note I'm only trying to design this for data stored on phones and tablets, not for communication systems or servers.

[1] Thumb drives would be more convenient, but they contain electronics and interface via a port that is very hackable.

RSA had to recall its SecurID tokens after Chinese hackers stole its keys, cloned tokens, and used them to break into defense contractors. So: it does happen.