This could work for domestic requests, but the one example of this I've seen in the wild (and this was mentioned in the original post) involved a request (supposedly) coming from police internationally. Though, requests from foreign police are more likely to be handled with scrutiny, so maybe forcing more manual verification (and identification of the proper process in the first place) aren't bad things.

Then local cops with poor security get hacked...