CNNIC would only ever see the public key, and you can't decrypt encrypted data using the public key--you must use the private key to decrypt the data, something

CNNIC would only ever see the public key, and you can't decrypt encrypted data using the public key--you must use the private key to decrypt the data, something CNNIC would not see--so no. As mentioned, CNNIC's inclusion only allows a Man In The Middle Attack. That is, CNNIC, i.e. the Chinese government, pretending to be a site they're not, and using their status as a Firefox (and other) -authorised root certificate provider to further trick the user into accepting the bogus SSL certificate as originating from the hijacked domain.