[any authority] could use [their] key to issue itself valid HTTPS certificates for verizon.com, eff.org, google.com, microsoft.com, or indeed any other website. [any authority] could use those certificates to conduct virtually undetectable surveillance and attacks against those sites. [any authoritiy's] keys could also possibly be used to obtain access to some corporate VPNs.

[EDIT] Are there any monitoring tools I can install to question the validity or motive of a certificate? It sounds absolutely silly even saying it, since I can't even keep up with other web browsing security measures: white-listing off-domain cookies my banks insist on issuing, deleting flash cookies, running no-script, etc...