The concern here isn't state actors; just lowly exit node operators looking to skeeze a buck. Check the other comments for how it's actually done. More import

The concern here isn't state actors; just lowly exit node operators looking to skeeze a buck. Check the other comments for how it's actually done. More importantly, I think your fear about state actors abusing trusted root certificates is unfounded. As soon as a malicious cert is found, the issuing root cert will be nuked from orbit by all the major browser vendors. It's not a viable option for state actors, especially when they have much better options (like the NSA tapping Google's internal networks, for example).