Ah, some key details are in that PDF that haven't been discussed in prior threads;
1) For services that do NOT involve end-to-end encryption, scanning is to be performed at SERVER SIDE -- no client side scanning required.
2) For services that DO involve end-to-end encryption, scanning is to be implemented within the APPLICATION on the client side -- no OS level backdoors required.