The public key infrastructure in modern browsers allows you to use HPKP, which gives you all you need in order to fully control that a message can only be read

The public key infrastructure in modern browsers allows you to use HPKP, which gives you all you need in order to fully control that a message can only be read by its intended recipient, if you need that level of assurance. (Yes, it's TOFU, but is there any large-scale protocol that isn't either TOFU or requires out-of-band verification?) The public key infrastructure in modern browsers is also about to require that CAs use Certificate Transparency (a year from now), which is definitely an obstacle even for nation-state adversaries if they want to stay under the radar (once it's fully rolled out and backdating in order to bypass the requirement isn't possible anymore). Finally, if you're the target of a nation-state adversary, there are probably things you'd have to worry about other than the Web PKI. It's unlikely to be the most effective way to own you. The Web PKI isn't the weakest link by far.