The feature, aimed at ‘high-risk’ users including politicians, journalists and dissidents, requires two hardware keys amongst other protections