Only Apple is able to sign iOS updates. The FBI wants Apple to make an Evil Update and sign it with their key so the phone will accept the update. Apple has to hold the signing key so the phone can reject Evil Updates in general.

Does this count as a "backdoor"? It's built into the way signed updates work. Nobody stole Sony's master signing key for the PS4, even when their entire network was pwned. They're probably stored offline in specialized hardware.

(as I understand it, newer iPhones use crypto magic + special hardware to make it arguably impossible to update the phone while it's locked, so they're more secure against Evil Updates, even ones signed by Apple)