Legally they can decrypt the content though, they have access to the key, they just need to change a piece of JavaScript so it sends back to the key to their server the next time a page visitor comes.

It's up to the courts and to them to decide. Perhaps they are doing it already, but just keeping it low-profile, so the "real" dangerous people get attracted to the service and caught.

Like VPNs.