Yes, frankly what you are proposing is the only viable solution I can see. The Chinese government can now man-in-the-middle any SSL connection from a browser t

Yes, frankly what you are proposing is the only viable solution I can see. The Chinese government can now man-in-the-middle any SSL connection from a browser that has their cert. Be it at a café in the U.S. (by having an agent sitting along side you) or any connection that goes through a router they control. In case you didn't know, this has already been the case for the U.S. government, the Taiwanese government, etc. because SSL root certs (at least the ones in your browser today) know no boundaries. SSH is secure because presumably you know when a certificate should be changing and are suspicious otherwise. Today's browsers don't warn you when a the root cert for a domain changes, but they could.