Governments can just run a "Real CA" trusted by most common web browsers, then that government run CA could occasionally emit new certificates of sites that the

Governments can just run a "Real CA" trusted by most common web browsers, then that government run CA could occasionally emit new certificates of sites that the government wants to me man in the middle for. Then government does not have to decrypt the information as they are already man in the middle. Some users get the sites original certificate, others get the MITM certificate and interception. Thus trusting central CA is somehow broken from a security point of view. How many end users really check the certificates is coming from the right CA and has correct fingerprint? Then you do not need to decrypt the SSL traffic. Much easier.