Depends, if a country is going after you, they can just print their own ssl certs through a CA they control. But also they can probs get you whenever wherever w

Depends, if a country is going after you, they can just print their own ssl certs through a CA they control. But also they can probs get you whenever wherever with some insane TCP stack RCE or some shit, so who cares if ur at a hotel. But also there are still some insecure protocols out there and sites that do not use HSTS. For instance, you can type wf.com in your browser to go to wells fargo, their login page secure.wellsfargo.com uses HSTS and you cannot go there not over SSL. But the main page doesn't. So if you just type wf and do not specify http/https it will still try http first and that can be intercepted and an attacker could change the link to secure.wellsfargo.com to just wellsfargo.com or whatever, and return the login page and phish you. SSL does solve the problem in most cases but sometimes if you're not paying attention you can not notice it's not being used / is being subverted. Also, there have been many MITM vulnerabilities found in various SSL libraries over time. Recently GNUTls had a vuln that let you MITM all connections. Similarly Microsoft with the curveball attack also allowed one to MITM https connections among many other things.