A state sponsored attacker has some (easy) possibilities that are normally out of the league of a normal attacker. Like showing up on the doorstep of a CA and

A state sponsored attacker has some (easy) possibilities that are normally out of the league of a normal attacker. Like showing up on the doorstep of a CA and asking them to issue forged SSL certificates. This was relevant for the pinning bug that was just fixed in Firefox 49: normal users shouldn't care about it, but it's very dangerous for Tor users.