Yeah that's correct, they can't do it in https unless they did something with root certs, which would be 1000x more messed up (And that's saying a lot because t

Yeah that's correct, they can't do it in https unless they did something with root certs, which would be 1000x more messed up (And that's saying a lot because this is already pretty despicable). At any rate if they were doing that browsers would revoke the CA.