Basically no. You would have to be forced to install an extra root certificate that allows the ISP to MITM your traffic, or have a CA turn rogue and start issu

Basically no. You would have to be forced to install an extra root certificate that allows the ISP to MITM your traffic, or have a CA turn rogue and start issuing certificates for other people (e.g. DigiNotar). Both of these attacks would be detected by the Certificate Transparency system, so everyone would know. And for very big domains (google/facebook) browsers pre-bundle the certs they expect to see and refuse to honour any other cert, this is known as static key pinning. Nation states would be more likely to just tap up Cloudflare to spy on the traffic since a huge % of the internet goes directly to them and is unencrypted at that point.