While this is scary, Mac OS X and various browsers also ship with CA certificates of questionable motivations, such as China's CNNIC. It's scary not only for i

While this is scary, Mac OS X and various browsers also ship with CA certificates of questionable motivations, such as China's CNNIC. It's scary not only for inhabitants of those countries, but also those outside. The relatively frequent reports of BGP glitches routing arbitrary traffic through places it shouldn't go don't fill me with confidence. In this particular case, do we know if the Tunisian government actually used this SSL MITM capability? Is there a reliable way to detect Internet Explorer at the SSL negotiation stage? If not, users of other browsers will see the "someone is trying to trick you" screen; you'd think that would be fairly obvious.