Simple. Immediately implement certificate pinning so that rogue CA's can't be used to MitM their application traffic. That should have happened long ago for these apps anyway. This will break those apps and the government, in the face of everything breaking for their citizens might re-think their plan and at a minimum, turn of TLS middling for the impacted domains.