How is this in category 3? Give decryption keys to your own government and not the others. I get it if you think it'll require more opsec from your government than you might trust them with, or that it'll have other negative effects (see: category 2), but how is this physically impossible (category 3)?