> why couldn't they be compelled to silently push a special update that exfiltrates all of my messages in plaintext?

See the FBI vs Apple case from a few years ago for an analysis of that.

> Why couldn't they use an escrow key secured in the same ways as update signing keys?

I would expect a key escrow service implemented to the same standards as current large PKI deployments (CPUs, mobile devices, CAs, large software distributions, etc) to be reasonably secure.

However!

* It further enables "turnkey authoritarianism" if and when an abusive regime comes to power.

* It introduces a single point of failure where there isn't one currently.

* It introduces complicated legal compliance issues where there aren't any currently.

* It isn't at all clear how it would relate to decentralized services. (It isn't even clear to me how GDPR is supposed to interact with things like Mastodon and Matrix.)

* It wouldn't actually be useful, because non-escrowed encryption (and stenography in case such is entirely outlawed) are both _readily available_ to actual criminals.

tl;dr: I don't live in China. Let's keep it that way.