The way this works is that the nation state installs a proxy that does a man-in-the-middle attack on the HTTPS traffic. It receives the incoming TLS handshake f

The way this works is that the nation state installs a proxy that does a man-in-the-middle attack on the HTTPS traffic. It receives the incoming TLS handshake from the endpoint, and completes it with a certificate rooted in a 'compromised CA'. Then they handshake with the real server, and proxy the traffic. This allows them to intercept the traffic by shunting the plaintext off of the proxy to another system. Of course, it's plainly obvious to you, the endpoint, that this is going on because have to trust that compromised CA on your device to access the site. They'll, of course, helpfully offer instructions about how to do this and require it to be pre-installed on systems. But if there's no other way to access any HTTPS services? Lots of people will do it.