Check out the CAs your browser trusts. It's a tire fire. People should be a lot more worried about corporate shenanigans than government.

One of the more interesting things you can do with a network tap is take a look at the certificates crossing the wire. Suricata has a tls-log section.