Well actually it is not that hard. The key is in escrow in another jurisdiction with dead man's switch and store it only in ram locally. When the legal order comes you just shut down the service and wait until the key is destroyed.

You can also rig the machine on which the key is used with something nasty that will melt it inside against physical tampering - lets call it SWAT raid protection.

Disclaimer - IANAL