Earlier this would probably have been a somewhat plausible solution, but not even then for mass scale surveillance. Assume NSA et. al had access to trusted CA

Earlier this would probably have been a somewhat plausible solution, but not even then for mass scale surveillance. Assume NSA et. al had access to trusted CA private keys, then they could generate certificates for arbitrary domains which would be trusted by clients. But if they MITM'ed _all_ connections (or even a large portion) surely someone would have noticed, like in the DigiNotar case [0]. But it's even harder (or better) now, with the advent of Certificate Transparency. Since browsers check certificates, periodically, against the CT logs which would fail for forged certificates [1]. However, stealing private keys from companies themselves is a practice that I can imagine happening on a small scale, like the Realtek signing keys for Stuxnet [2]. But doing that on a large scale is not really sustainable. [0]: https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudulent_certificates https://en.wikipedia.org/wiki/DigiNotar#Issuance_of_fraudule... [1]: https://security.stackexchange.com/questions/190096/how-will-certificate-transparency-be-enforced https://security.stackexchange.com/questions/190096/how-will... [2]: https://en.wikipedia.org/wiki/Stuxnet#Windows_infection https://en.wikipedia.org/wiki/Stuxnet#Windows_infection