If they issued a malicious certificate they would not be able to hide it. Certificate Transparency logs are now mandatory for all TLS certificates: https://en

If they issued a malicious certificate they would not be able to hide it. Certificate Transparency logs are now mandatory for all TLS certificates: https://en.m.wikipedia.org/wiki/Certificate_Transparency https://en.m.wikipedia.org/wiki/Certificate_Transparency The log is like a git hash-chain: you can never erase the past without affecting the whole chain after the erasure. If you want hidden backdoors, put them in hardware, not software. Chips are the best place.