We all talk about using SSL everywhere protects people from NSA/GCHQ/... It may prevent script kiddies to use Firesheep but as far as I understand if the NSA/GC

We all talk about using SSL everywhere protects people from NSA/GCHQ/... It may prevent script kiddies to use Firesheep but as far as I understand if the NSA/GCHQ has access to any key from any Root CA (which I highly assume) then it doesn't matter at all to the NSA/GCHQ what kind of encryption we use as they can do easily MITM attacks (anyone checking SHA1 from the certificates from a reliable source, whatever this means?). The same is true that at several companies I worked for, people had to install (or per automatic software update) a fake certificate to allow the proxy to spy on all traffic. In one case I tried to fight against it, but I was the only developer of the 80 developer which cared. Their reasoning was totally flawed (which I demonstrated, e.g. that it protects against viruses, which it didn't, as the proxy only checked the first few MiB) but despite that, it was signed by management etc. Maybe I made I mistake in my reasoning and I hope someone explains my why, but in my opinion SSL (despite the script kiddie example) is broken as long as we have to trust companies which we shouldn't trust at all.