I don't believe CALEA has any provisions for requiring CA providers to allow decrypt.