What verifiable evidence do you have that no NSLs have been issued demanding encryption keys, or that all such NSLs have been successfully challenged in court?
That is what is legal. So sure, if the FBI was going to completely violate the law they can send something that looks like an NSL. But they could do that even if NSL isn't legal.
It's irrelevant. The ECI leaks had one statement that said that the FBI "compels" US companies to assist in "SIGINT-enabling" (backdoors or taps). We should assume they can secretly order such things given it was in the most secretive leaks.
For foreign companies, they sent the black bag operators of CIA or ISA to get job done. ISA is an interesting outfit to have coming after you or your data.
So, she could legally be compelled to do something disuptive to catch criminals like Feds do all the time in physical spaces (esp hotels). Thing is, leaving to avoid that might put her at risk of what's used outside jurisdiction. Fleeing was a bad move.
You can't NSL "how does TOR work?" or "give me the encryption keys to X."
What an NSL can do is say "give me a list of emails sent by XYZ@yourdomain.com" and you aren't allowed to tell anyone.