They should be required to place the keys and the initial software build into escrow, so either when a fixed time has elapsed, or they have been found cupable for a breach of an applicable law (e.g. if they stop providing software updates).