If your communications can land you in jail or get you killed don't use the internet (or even a computer, keystroke loggers are easy to install and very hard to

If your communications can land you in jail or get you killed don't use the internet (or even a computer, keystroke loggers are easy to install and very hard to detect), no matter how clever you think you are, and no matter how many 'lock' icons appear in your browser. In such cases paranoia is perfectly justified. It's a real pity this requires a code update because that means that the change will take long to propagate and will likely never be really complete, at the same time I'm sure there are good reasons for that and that an automated process to revoke just any certificate could itself probably be used as an attack vector. What would happen if they simply revoked the root certificate that was used to sign this fake?