One would assume they forced a CA to sign a false google.com certificate and substituted that for the real one, MitM style, in order to do the decryption. Gove

One would assume they forced a CA to sign a false google.com certificate and substituted that for the real one, MitM style, in order to do the decryption. Governments are obviously capable of this. Firefox's Cert Patrol or Chrome's certificate pinning are really the best defenses against this kind of thing. If you're on Chrome 13 or later, you're mostly guaranteed that gmail.com is the real deal.