That is almost certainly already compromised. If the NSA cannot create arbitrary certs trusted by your browser, I'd be utterly shocked.

There have been several cert-vendor compromises publicized over the years - how many weren't publicized/discovered, and now many were not compromises, but rather subversions?