A root CA certificate doesn't allow you to "MITM you heart away". Its purpose, as would be clear if you think about what the CA does with it, is to sign other certificates for keys which in turn are used to sign certificates that identify machines.

So first of all this hypothetical government would have to issue itself certificates for any sites it was interested in intercepting, and intercept the traffic to impose a MITM. It has to do this live or it won't work. Every time it does this, it provides the other participant a smoking gun, which is to say evidence - in the form of these bogus certificates.

But wait, if you run Chrome, Safari or similar browsers, these certificates just won't work. To be functional the government has to obtain proof they were logged for everybody to see - in the Certificate Transparency system. Without that the user just gets an error telling them the certificate isn't logged and can't be trusted.

If they were logged, we all get to see them. Do you see them? No, because this isn't actually a thing. It's a paranoid fantasy.

I think they meant unrestricted signing certificate. A few CA's have been caught providing this to external entities and have been pulled from trust stores. The cynical side of me assumes the behavior just moves to another shell company. For those curious how to mitigate or at least identify when this is occurring, you could trust transparency reports, or if you don't trust those, then log certificate fingerprints of the sites you visit.

  for domain in $(cat ./mydomains.txt); do echo -en "${domain} "; openssl s_client -servername "${domain}" -connect "${domain}":443 < /dev/null 2>/dev/null | openssl x509 -fingerprint -noout -in /dev/stdin; done|sort -k2 -t"=" | awk {'print $NF "\t" $1'} | column -t

  Fingerprint=4C:B1:F9:42:9A:58:CB:E2:7F:92:27:A9:41:5B:15:8B:01:3B:D1:64  ycombinator.com
  Fingerprint=98:70:50:FF:B9:05:CA:D3:A7:9A:85:96:C2:12:0D:B9:7C:03:A1:65  news.ycombinator.com

It's probably also worth logging the creation/expiration dates too, given that certs expire so much quicker these days. If you wanted to make this information even more useful, have people all around the world run this and feed it into a distributed database and log the ISP the test was run from so that you can see if a particular ISP has been compromised. That is how some folks I know in Africa found out their ISP was using BlueCoat proxies and that the certs were being installed as part of their ISP's required package downloads.

This seems like an over-complicated non-solution. If your browser is trusting some other root, you can see that information in the browser. For example if I click the padlock for this site, and pick More Information / View Certificate, sure enough this is a certificate issued from DigiCert.

But also, it's basically game over if you agree to run arbitrary software other people pick, so that's where the real problem is for the African case you describe.

yes, but it'd be the ISPs storing the internet history

Backbones have the reputation of being filled with intercepting devices from various entities, including gov's own.

Intercepting at line rate isn't a thing. Recording absolutely happens, but that's why we're talking about End to End Encryption. It would suit snoops very much if what they recorded wasn't 90% unintelligible noise.

Right now they get a good idea which sites are visited (because of Server Name Indication) by web browsers, and they get some portion of email (sent in the clear) plus a small fraction of web traffic (HTTP-only) and numerous older unencrypted protocols.

In particular they also get most of DNS. DPRIVE work (DNS over TLS, DNS over HTTPS, and eventually DNS over QUIC) reduces that considerably. Future DPRIVE work also includes oblivious transfer (you ask say Google to do a DNS lookup on your behalf, they learn who you are and which DNS server was asked but not what you asked it, the DNS server learns what was asked but not who you are, you get your answer).

Or of course, if you're particularly worried, you use Tor and everything on the snoops' screens dissolves into noise.

wouldn't certificate pinning partially prevent this though? i'm not saying this is impossible, but for regular ISP-logged data that some schmuck wants access to, rather than a 3 letter agency or whatever, i doubt this is much of a concern