The security implication is that the government can use it to sign certificates for any website of their choice. This means that they can snoop and/or replace t

The security implication is that the government can use it to sign certificates for any website of their choice. This means that they can snoop and/or replace the content. Mitigating this, there are mechanisms to keep track of which certificates are used for which websites, so this could catch them in the act. However, note that "Root CAs manually added to the trust store override and suppress Expect-CT reports/enforcement." Since this is the Spanish government, it seems likely they will target Catalonia somehow.