Using a local CA seems like a bad way for a government to compromise HTTPS. If they got caught, that CA would get demolished practically overnight when the bro

Using a local CA seems like a bad way for a government to compromise HTTPS. If they got caught, that CA would get demolished practically overnight when the browser makers remove it from the trust stores. Compromising a foreign CA seems like a much better strategy. (Although not nearly as simple)