I disagree on one point : any acceptable solution must include a warrant approved by a judge whose decision will be recorded and subject to FOI requests.
It is useless to try and limit the amount of interceptions allowed - how can you ensure they will respect that ? They're already respecting nothing. Put a judge in charge and jail him if he gets too cosy with the spooks. With a public record of intercept warrants, we regain some control of the situation.