It's easy to forget how utterly fucked up things have become, compared to how a few decades ago, we(? well, at least I) thought things would evolve, and one of those has to do with dedicated services for secure communications.
The thing that defies my predictions, is that dedicated services for secure communications, exist at all.
When you wanted to secure email, you didn't use a "secure email" service; you (the user!) just added security onto your insecure email service. Send a PGP/MIME message and the email provider doesn't give a damn that it's encrypted, it just cares about SMTP.
But these days (could I call it the "Age of Lack of Standards"?), everyone is trying to manipulate you into depending on their software and services (inextricably linked; you can't use their software without their service, or their service without their software), so you can't just replace the service or easily "tunnel" security through their presumably-insecure (perhaps even mandated insecure) service. Whatever security they offer, is all you can reasonably get (pretty much the opposite of the classic email situation).
Why do I bring this up? Because the regulations are all about services! Not protocols. Not software. Services. (emphasis mine in all below quotes)
Here's the beginning of The UK Online Safety Act (1)(1)(a):
imposes duties which, in broad terms, require providers of services regulated by this Act to identify, mitigate and manage the risks of harm
Here's good 'ol CALEA (US Code title 47 Section 1002 (a):
Except as provided in subsections (b), (c), and (d) of this section and sections 1007(a) and 1008(b) and (d) of this title, a telecommunications carrier shall ensure that ...
CALEA even mentions encryption:
A telecommunications carrier shall not be responsible for decrypting, or ensuring the government’s ability to decrypt, any communication encrypted by a subscriber or customer, unless the encryption was provided by the carrier and the carrier possesses the information necessary to decrypt the communication.
I haven't dived into the details of EU's DSA, but I see a hopeful sign right there at the very beginning of Article 1:
The aim of this Regulation is to contribute to the proper functioning of the internal market for intermediary services by setting out harmonised rules...
Look at all those references to services! Not the code you run; the services you use.
What does it mean? I think it might mean that even in the UK(!) you might be perfectly fine and legal using secure software. You just can't have it rely on some coercible corporation's secure services. Send your encrypted blobs over generic protocols and un-dedicated services, and the law won't apply to your situation. I'm not necessarily saying "Make PGP/MIME Great Again" but I do think following in its spirit is a really great idea.
If you run a service, what you want to be able to tell the government (whether it's US or UK or France/Germany) is "we don't provide any encryption, though some of our customers supply their own."
Stop asking for secure services. Worse is better. Ask for secure software (which assumes that all services are completely hostile) decoupled from any particular service.