What do you mean by that? Like a country redirects DNS resolution to their own controlled IP's and gets one of their CA's to issue duplicate certs? That could c

What do you mean by that? Like a country redirects DNS resolution to their own controlled IP's and gets one of their CA's to issue duplicate certs? That could certainly happen and would be devastatingly effective until other people catch on. Spoofing IP's alone isn't enough, but CA infrastructure is very much based on a trust that is weaker than we'd like to admit.