It's just an attempt to add a salacious element to an otherwise dry story.

It's like taking the Chevy Bolt announcement and adding "General Motors, owners of the Hummer brand and makers of black SUVs, is known to have long standing business relationships with military and intelligence services."

That analogy is actually pretty weak.

When you buy Chevy Bolt, your not expecting to use TLS to securely lock your doors.

However, if ACM is compromised by a "spy agency" — then anything you intended to be protected by a secure HTTPS transport is now logged, and easily decrypt-able by the "spy agency" at their convenience.

When you buy a Chevy Bolt, you may not realize that a) the government knows everywhere you drive, and b) law enforcement can remotely disable your car via OnStar.

Not only that, they can listen to your in-car conversations: http://www.zdnet.com/article/fbi-taps-cell-phone-mic-as-eave...

Not a problem unless your a criminal.

With foresight like this, who needs to worry?

Chelsea Manning is a criminal.

Why is the key to my car less important than the key to my website?

It's highly likely that my car has a lot of where I go, what I listen to, how long I idle, etc.

If you're really worried about spy agencies tracking you, your car is a much riper target. LPRs are everywhere.

In what scenario is ACM compromised but the spy agency cannot compel Amazon to grant access to any other service?

Changing which private key your ELB used doesn't change the fact that you were already trusting Amazon to operate it.

But with OnStar services, they can unlock your car without your knowledge to do who knows what, and track your vehicle's movements without your knowledge... so, it's not THAT much of a difference.

Do you wonder why the European Data Protection Agencies are getting ready to block all EU-US data transfer soon?

and create their own "security" certificates?

That's probably still better then tolerating economic espionage. But since this very dreaming, I personally still hope for the new Audit of CAcert end of this month. The CAcert root certificate would be a reason for me to use letsencrypt only as a fallback for HPKP.

Didn't realize they were still moving forward with that (despite using CAcerts myself). Thanks for the heads up. I suppose that's as good an excuse as any to hold off a bit on moving to letsencrypt (To be clear, with CAcert not being in any of the default cert-stores, I wouldn't recommend avoiding letsencrypt in favour of CAcert to the casual user -- but I don't (currently) need a widely trusted anchor for what I use CAcert for. Even if it would've been nice if it was widely trusted out of the box).

Why the scare quotes? Some EU countries have a better record than the US on bulk surveillance of their own citizens. It is perfectly natural that if the US won't respect their citizens basic human rights then those countries will have to place restrictions on the US.

EDIT Not to say that all EU countries have a better record. The UK performs bulk surveillance on a huge scale.