Whilst true that's not the whole picture. This law isn't actually as draconian as it sounds: the prosecutors must prove to a very high standard that you do actually know the key, and haven't really forgotten. For instance if you typed in the password the day before you were arrested, that's probably a good sign you know it. If you haven't used it for a year and claim you forgot it ... or if they can't actually prove you know the password at all ... then you don't go down for it (in theory).
Now perhaps you object to the general principle. But let me ask you what your proposed balance is? If you're against mass surveillance and bulk collection (like I am) then this leaves the question of how can governments investigate crimes? Should they be regulating technology at all? I'd really prefer not. "Tell us the password so we can investigate the contents of this device" is low tech and has very limited potential to be abused for social control because it doesn't scale. You can't use this law to do bulk surveillance. So in the end it seems like the lesser evil.