I don't know. I feel, if you're a government or an intelligence service, you already have enough methods to acquire fake certificates: If the target domain has

I don't know. I feel, if you're a government or an intelligence service, you already have enough methods to acquire fake certificates: If the target domain has your country's TLD, you can compel your national registrar to manipulate DNS records, then get yourself a perfectly legitimate Let's Encrypt certificate for that domain. Alternatively, you can go the direct route and approach one of the various private CAs in your country and force them to generate you the certificate you want.