> Every major corporate network … That specific complaint seems to me more about trusted roots - corporate can just install their own CA cert on each machine.

> Every major corporate network … That specific complaint seems to me more about trusted roots - corporate can just install their own CA cert on each machine. What backdoor are you talking about? Sounds like administrative access to the computers owned by the company. The seasoning and digesting doesn’t solve that problem. Every company also has the wherewithal to copy/store/transmit anything typed into an input field on computers they own. If there’s some other intentional “browser backdoor” (not social engineering attempts against end users) for installing random signing certs, I’d like to read about it. If I own the hardware and control the software installed on it (notwithstanding infiltration), none if my TLS traffic is peeled open on the way to its destination.