Virtual fort knox would be impossible to secure. In the modern age, whether through stupidity or malice, those keys WOULD be stolen, leaked, breached, what have you. Hell, the first time the US government tried this situation, the clipper chip, it was trivially bypassed and shown to be utterly broken by researchers

Sure, Clipper was a disaster, but we've learned a lot about encryption since 1998. I still think key escrow and gov't backdoors are probably a bad idea, especially when you look at the US's privileged position in the internet, which should really be a global or jurisdiction-free space. However, I don't understand why it would be so much harder to protect these keys than the update signing keys that Apple, Google, Microsoft, etc (not to mention every app author including Facebook) already have to protect in order to prevent malicious actors (including nation states) from trivially bypassing all security protections by pushing a signed update to the end-user device.

Honestly if your security model involves hiding from the FBI/NSA, you should not be using a cell phone to do your encryption/decryption. That device runs closed-source blobs and can be remotely configured, accessed, and updated by (at least) your carrier and the device manufacturer.

Don’t Apple, Google and Microsoft already have keys that can be used to automatically update and backdoor any of the billions of devices running their OSes?

Make it distributed.

Have each phone generate a public/private key pair, and upload the public key to an anonymous repository.

To escrow a key the client app uses a secret sharing system to generate 10000 key shares, with any 500 key shares being sufficient to reconstruct the escrow key. It encrypts each share with a randomly chosen public key from the anonymous repository. It sends these encrypted shares to the government.

If the government wants to recover the escrow key, it has to make a public request for help in which it publishes the 10000 encrypted key shares. Have an app on the phone that can receive notification of such requests, and if it sees that your public key was used for one of the shares it asks you if you approve the government's request to recover the escrow key, and presents the government's argument in favor of this.

If you approve, the app on your phone decrypts the share, encrypts it with a government key, and uploads it anonymously to the government.

In effect, this system provides a jury of 10000 randomly chosen anonymous phone users to review the access request, and 500 of them have to approve in order for access to be granted.

Relying on people who are actively using phones, to find time to make carefully consideted and measured judgements in the name of justice is ridiculous. Full stop.

Has Apple, Google, or Microsoft ever lost the private key for signing code for delivery on devices?

Not saying this is a good idea, but big tech seems to have figured out how to keep a number secret. This argument may not be very strong as a result.

Windows update was subverted previously, but it was a man in the middle attack: https://www.wired.com/2013/03/flame-windows-update-copycat/

ASUS did actually deliver a malicious update: https://www.vice.com/en_us/article/pan9wn/hackers-hijacked-a...

> why couldn't they be compelled to silently push a special update that exfiltrates all of my messages in plaintext?

See the FBI vs Apple case from a few years ago for an analysis of that.

> Why couldn't they use an escrow key secured in the same ways as update signing keys?

I would expect a key escrow service implemented to the same standards as current large PKI deployments (CPUs, mobile devices, CAs, large software distributions, etc) to be reasonably secure.

However!

* It further enables "turnkey authoritarianism" if and when an abusive regime comes to power.

* It introduces a single point of failure where there isn't one currently.

* It introduces complicated legal compliance issues where there aren't any currently.

* It isn't at all clear how it would relate to decentralized services. (It isn't even clear to me how GDPR is supposed to interact with things like Mastodon and Matrix.)

* It wouldn't actually be useful, because non-escrowed encryption (and stenography in case such is entirely outlawed) are both _readily available_ to actual criminals.

tl;dr: I don't live in China. Let's keep it that way.

It might be possible for the US to successfully hang onto the keys, at least for a while, but you'd have to hand out keys to dozens governments. Given the general level of corruption in the world, some of those would probably be perfectly happy to sell access.