Your understanding is not accurate from my read of the court docs. They wanted their black box (you know the ones), called a pen/trap device in the documents, to be installed on the network. It won't work without the SSL keys, so they wanted those. He offered to modify his software to intercept a single user's email, but they said no.