> but that's exceedingly rare and hard to do

It could be possible that the government just requests certificate keys from the relevant tech company.