MITM isn't the issue, we assume for the most part that the NSA is a passive eavesdropper. Easier in that situation to sniff and decode with a stolen secret, rather than rewriting traffic on the fly.

Right, but my point is that the CA is the central point of failure for all of those scenarios.

Not really. For a passive attack the key would have to be stolen from a server rather then the CA, who never sees the private key, rather only the CSR (public key).

We're assuming under the current circumstances that it's backdoored, basically. The NSA definitely doesn't want to have to go knock on doors to collect those private keys.

The CA doesn't usually have access to your private key - they just sign the public key.

Right, I've gotten certs before. I'm saying that they could be faking certs for their own usage, and we're also assuming they have subtle backdoors in openssl, for example, to perhaps render having the private key moot.