They don't need compromised CA, you can mandate all devices in your country to install your root cert, good part it failed: https://www.privateinternetaccess.c

They don't need compromised CA, you can mandate all devices in your country to install your root cert, good part it failed: https://www.privateinternetaccess.com/blog/kazakhstan-tries-and-fails-to-mitm-all-of-its-internet-users-with-rogue-certificate-installation/ https://www.privateinternetaccess.com/blog/kazakhstan-tries-...