I feel like there's good theoretical comp sci work to be done here to show that this system won't work. I've outlined two open problems below:

APPROACH 1:

Suppose we have a state issued crypto-system F0(Tc) -> Tp. Alice decides to place another crypto-system F1 on top of that which the state doesn't know about.

Alice unlocks her phone which runs the state's system F0(Tp) -> T1. However, T1 is still encrypted by the unauthorized second-tier crypto-system, F1. This middleware piece of software then runs F1(T1) -> Tp and we have our plaintext. The state, of course, doesn't have the backdoor keys to F1.

The question is how can one prevent this secondary crypto-system from existing? And if one can't, doesn't it make F0 merely a useless ornament that unwraps one cyphertext matryoshka only to reveal another?

APPROACH 2:

idea: any system with a built in guarantee of access by a delegated third party is in contradiction with some theoretical constraints of a generalized security system and puts the whole construction in a lowered security 'level' which had a smaller set of assurances.

Given a user generated token Ku, ciphered text Tc, and plaintext Tp, you have decryption as a function:

F0(Tc, Kc) -> Tp

This requirement is for another key to exist for the State, Ka such that a decryption function F1 (which may or may not be the same as F0) yields:

F1(Tc, Ka) -> Tp

Ka is allowed to be a "salted" key on a per device basis so it can vary across devices as an input to F1.

It does this through another secret function, F2 whose input will be the per-device salt Ds, and a super-global law enforcement key Kl - our secretly held master key.

Law enforcement applies the secret key Kl on the Device and generates the device's master key, Ka by using the Device's Salt:

F2(Ds, Kl) -> Ka

This means that for the law enforcement it's

F1(Tc, F2(Ds, Kl)) -> Tp

Where F1, F2, and Kl are secrets. Tp, Tc, and Ds is known by us and we are free to change.

Here's the issues:

Kl is global across all devices.

F1() must always work regardless of user generated Ku although Ds is allowed to change as a function of Ku.

If I can generate as many Tc and Ds as I can, can we show that given a known F0, F1 and F2 can only be constructed from a exhaustibly reasonable finite set.

How about the idea that the cost of brute-forcing Kl, the master law enforcement key, continually decreases as the number of devices that Kl can open, thus the value of Kl, continually increases? What do the range of those slopes look like?