>but a back-door exists that allows anyone with access to it to bypass the encryption

The trick is you don't do that. Ideally you would only want people with a valid warrant would be able to also decrypt the message (bypass the encryption). So the problem is that you want to design a system where this is possible. Perhaps it takes the cooperation of someone from the government and someone from within the company to verify the warrant. Perhaps you have a list of people who need to cryptographically sign the warrant.