The BSI is part of the executive, just as the police or the intelligence agencies, and its certs have been abused for that before.

There are a few stories about this in the 2013 Snowden data actually, the SPIEGEL published stories about that back then, too.

I have never heard of any of their certs being abused before and I have followed the Snowden revelations closely. The only thing I know of are some vague "cooperations with the NSA" that never have been described more closely. I don't think they even have a root certificate trusted by browsers. A publicly owned company (the Bundesdruckerei) does, however.

I have to be honest, I don't care that much about the details on this.

I'm far more enraged by the decision of the Bundesdruckerei to not offer on-card signing features for the ePerso anymore.

Instead, you have to use their web service to sign, and it costs you even more money. And is obviously ridiculously insecure.

Then please don't go around claiming "the German police has a trusted root CA and has used it for MitM in the past" if you don't actually know that.