
To me, a larger problem is that once disclosed, your keys could be used
to decrypt any previously recorded conversations. I gather that from this
proposal a warrant would be required to get the keys, but not to collect
conversations! Consider the scenario where an agency collects preemptively
all encrypted conversations for certain people likely to be targets (and
not necessarily "legitimate" targets), then arranges for some unrelated
incident that can trigger a warrant:

   "Your honor, we know that the suspect has received calls from noted 
crime figure Bugsy Butthead [said calls arranged by the agency] and we must 
therefore have this warrant to determine whether this suspect, in a
sensitive govt post, is corrupt."

  I suppose that it is conceivable that there are session keys involved
somewhere, but that doesn't seem likely; if there are, why wouldn't the
technical overview mention them when it goes to such details as the number
of bits held by each escrow authority?

  This scheme is full of holes, and stinks to high heaven.

  -mel