I figured an NSL could require Google Play to issue an “update” for that user which was just a backdoored client. Or similarly, require Signal to do something like that. As lavabit was pressured to do.