I think it's very risky to conflate different classes of threat. Yes, the state could suborn a CA but simply using SSL does not make you stand out. Using software which is designed to evade surveillance is by itself a bad thing to be caught possessing and unless it's perfect it will leave traces which will draw attention.

The problem I'm concerned with is the promise: tell people that something like this works and they are likely to trust it – at least until news spreads about other people getting caught by basic statistical traffic analysis. This is basically the Bitcoin anonymity trap: the marketing guys like to run around telling people it's anonymous and people often miss the distinction that any mistake will cause it to fail open with a full public history.