As long as the Chinese authorities do not use CNNIC ( or whatever other root certificates they could obtain) to mitm SSL connections, they have the ability to e

As long as the Chinese authorities do not use CNNIC ( or whatever other root certificates they could obtain) to mitm SSL connections, they have the ability to escalate attacks. On the other hand, once eavesdropping escalates to this level, it will loose quite quickly all effect. ( Since everyone will then restrict certificates to trusted ones.) So the Chinese authorities probably save this possibility as a measure of last resort. Instead of encouraging everyone to look for a safer alternative than SSL.