The only thing you need to tap into a SSL-secured infrastructure is an inside guy who has read access to the private key. Essentially, anyone with root access to the front-end server. That doesn't leave behind any traces.

Same for breaking into the networks (like the NSA did with the Google data center interconnections): you only need to know into which fiber you have to place a tap module into. And a subpoena or whatever against the company providing the fiber service (as most of the fibers are leased to Google by some other infrastructure company).