Except that's demonstrably not what the NSA was doing; they were sniffing the backbones at the switches, presumably because they didn't want to create any sort

Except that's demonstrably not what the NSA was doing; they were sniffing the backbones at the switches, presumably because they didn't want to create any sort of paper trail or get warrants, even secret FISA ones, against particular people. From Google's perspective, it means they have to be involved, however non-consensually, in the process, rather than having it done to them transparently. So I can see why it's a win for them. Whether it really matters to Joe Random User is arguable. What Joe User really ought to demand is end-to-end encryption rather than transit encryption, but he's unlikely to do that because key management across multiple devices (and who wants to read their email only on a single device?) is a pain and the companies that would be able to make it less of a pain aren't exactly incentivized to do so.