They're going to intercept the key exchange and then verify the keys in real time? And then make an allow or block decision? This is very hard, you ultimately

They're going to intercept the key exchange and then verify the keys in real time? And then make an allow or block decision? This is very hard, you ultimately have to do deep packet inspection on everything to do this. (think of all the "starttls" protocols..) And SSH keys aren't part of a PKI... The best IPS products in the world are way way way off from that. As I understand the current "great firewall" it simply won't resolve sites they restrict access to, mostly social networking sites were my experience while I was there. FWIW, when they censor CNN they just black the screen out, they don't exactly hide what they're doing. Personally, I think you're right that this is mostly about money. I don't like the fact that it could be about other things, I really don't like the fact that they could just turn off the internet for the whole country, I don't see it being possible to restrict traffic like you suggest though. A lot of businesses do business there and have VPNs to China... They won't just hand the keys over and what does China do when they change them? Back to the CA though, do you really suffer if you just block access to and from .cn? I've had firewall policies over the years where I've turned large chunks of countries off and I can't say I feel like it's had much of an adverse affect on things. When I'm ready to do business directly with China then I can but until then it doesn't seem like it hurts much.