It's much simpler than that. Their marketing team gets their material from the R&D team, and neither group knows about the NSLs, because why would they? Only compliance and a few people on legal know, and everyone hates them already anyway.
You cannot perform an audit on your own. You are trusting that you received the correct keys without a way to verify identities outside of the network.
That is not secure. Please read http://blog.quarkslab.com/imessage-privacy.html
Is that seriously what you believe?