If someone has the private key to a trusted root certificate, they can forge the certificates for any TLS connections you make. The countermeasure is certifica

If someone has the private key to a trusted root certificate, they can forge the certificates for any TLS connections you make. The countermeasure is certificate pinning, but that is typically implemented only for a handful of sites; e.g. Google with Chrome.