For the PKI/CA part, yes (kind of.) There, the NSA can command a CA based in the U.S. to issue them an intermediary CA cert which would allow them to do active

For the PKI/CA part, yes (kind of.) There, the NSA can command a CA based in the U.S. to issue them an intermediary CA cert which would allow them to do active MITM for nearly all servers in the world. (They would still need the individual service providers' private keys to do passive MITM and decrypt already-captured traffic, though.) With just self-signed certificates, the NSA would need an individual's private key. The problem here is that there's no third party to confirm that public key X really belongs to your friend Jane and not the NSA, and thus it's hard to confirm that you're actually speaking directly to Jane, and not to Jane through the NSA. This is a hard problem, and one of the most effective workarounds we have is the support in OTR (typically used over XMPP) for the socialist millionaire protocol, which is a way for two people to confirm that they both know some low-entropy secret that they exchanged over an outside channel/in person, e.g. "batman", without revealing what the secret actually is. If the protocol fails, you can just break the connection. (Yes, I know that all of this assumes that the client software is written right, and that the NSA hasn't broken e.g. AES-GCM or chacha20poly1305 in TLS 1.2. As of right it doesn't look that way.) (I'm also acutely aware that our hypothetical attack model doesn't factor in all of the NSA's other tricks, but that's a very deep rabbit hole.)