Interestingly, I looked up the symantec CEO. He was previously the ceo of Blue Coat. Blue Coat is a maker of man in the middle proxy appliances for businesses to spy on their employees. They controversially got root certificate authority. Which could of course be used to mitm SSL sites (which they promised and crossed their heart they would never do).

https://www.theregister.co.uk/2016/05/27/blue_coat_ca_certs/

Symantec told us that there was a clear separation between the Blue Coat interception business and the CA business. Now, whether we should believe that having distrusted Symantec is a reasonable question, but of course distrusting the Symantec CA function also makes the question rather academic.

For users with Certificate Transparency checking (basically, Chrome) any dubious MITM certificates would have to be logged to show up as trusted public certificates. So there would not only be a smoking gun in the sense of the MITM cert being sent to all browsers that connected, it would be permanently preserved.

In addition Mozilla has an ongoing programme of trying to discover all the intermediate CAs that actually exist, partly because this occasions them to find various intermediates that probably _shouldn't_ exist and get them blacklisted. So this means if a intermediate exists and then you say you didn't realise it was being abused, you have the problem of explaining why you didn't report that it exists. If you say it's because you didn't know, it makes things worse - like if you say you didn't tell the IRS about the money because you got it when committing an armed robbery you weren't previously in the frame for - because that means your CA root was used to sign things you don't have a record of, and so obviously we can't trust your root any more...

Didn't someone at the Tor Project analyse these Blue Coat MiTM boxes and find a cross-signed intermediate signing certificate preloaded, with the option to load your own signing cert so one could MiTM with ease? This was more than a few years back...