The UK has key disclosure requirements in RIPA. There's a 2 year prison sentence (5 years if it's a national security or child indecency case).
Key disclosure: https://www.legislation.gov.uk/ukpga/2000/23/part/III
Failure to comply with a notice: https://www.legislation.gov.uk/ukpga/2000/23/section/53
Same issue as the US where the Supreme Court should still rule about this whole right to not incriminate yourself / remain silent by not revealing a password.
No such cases have reached those jurisdiction yet as far as I know?
What makes you think it's not already legal?
And some member states never really ruled on the matter clearly.
Now it's pretty clear and I have to agree and re-reading this ruling entirely that this is in fact making mass surveillance legal under an apparent cover of limiting it. Making your initial ending remark completely true.
The only defense against surveillance of communication channels is to make it technically impossible. Respecting privacy may be a misnomer here, they just have to adhere to EU law, which probably leaves room to let state actors continue exactly as before.
edit: "no mass surveillance without limits" titles techcrunch. As if the "limits" could make mass surveillance acceptable. This article is "fake news" in the original sense, because they actually reduced barriers for mass surveillance.