and create their own "security" certificates?

That's probably still better then tolerating economic espionage. But since this very dreaming, I personally still hope for the new Audit of CAcert end of this month. The CAcert root certificate would be a reason for me to use letsencrypt only as a fallback for HPKP.

Didn't realize they were still moving forward with that (despite using CAcerts myself). Thanks for the heads up. I suppose that's as good an excuse as any to hold off a bit on moving to letsencrypt (To be clear, with CAcert not being in any of the default cert-stores, I wouldn't recommend avoiding letsencrypt in favour of CAcert to the casual user -- but I don't (currently) need a widely trusted anchor for what I use CAcert for. Even if it would've been nice if it was widely trusted out of the box).

Why the scare quotes? Some EU countries have a better record than the US on bulk surveillance of their own citizens. It is perfectly natural that if the US won't respect their citizens basic human rights then those countries will have to place restrictions on the US.

EDIT Not to say that all EU countries have a better record. The UK performs bulk surveillance on a huge scale.