Not to sound more cynical than the situation warrants, but in this case I'm not particularly surprised or disappointed. Congress is clueless and more concerned with partisan politics and re-election fundraising.
We should be (and many are) working to secure ourselves so that Congress and the legal system must work to catch up to the possibilities of citizens to protect themselves on their own terms: good end-to-end encryption, true anonymity when it's needed, and as much open and auditable code as we can get.
They're not going to give security and privacy to us — they wouldn't even if they could. So we make it ourselves, slowly, surely, and publicly, and maybe in a few years they'll be the ones that are outraged.
You will, however, be bound by current 'lawful intercept and storage' laws. If you provide a remote computing service (email, hosting, cloud storage, fitness tracking, etc) you will be bound by 18 U.S.C. § 2703(f) [1]. If you provide telecommunications you will be bound by CALEA [2]. You will be bound by the Stored Communications Act and by the Patriot Act, and you will be bound to provide access to the core of your service and/or your private keys if you are given an NSL.
Essentially - you can not provide secure communication as a service.
If you try to provide it as a product it's more blurry. With precedents like Blackberry, RSA and Skype you need to make sure you're operationally able to deal with extreme levels of leverage and influence.
We should be (and many are) working to secure ourselves so that Congress and the legal system must work to catch up to the possibilities of citizens to protect themselves on their own terms: good end-to-end encryption, true anonymity when it's needed, and as much open and auditable code as we can get.
They're not going to give security and privacy to us — they wouldn't even if they could. So we make it ourselves, slowly, surely, and publicly, and maybe in a few years they'll be the ones that are outraged.