And how would "compliance and legal" get access to something engineering designed to be end-to-end encrypted?
You cannot perform an audit on your own. You are trusting that you received the correct keys without a way to verify identities outside of the network.
That is not secure. Please read http://blog.quarkslab.com/imessage-privacy.html
Is that seriously what you believe?