They can't sell the keys since they don't have them. NSA could still mount an attack by asking the CA to register NSA's certs as valid, and tamper the victim's

They can't sell the keys since they don't have them. NSA could still mount an attack by asking the CA to register NSA's certs as valid, and tamper the victim's network connection. What makes certs secure is our trust in certificate authorities.