It strike me that this tools works (or is perhaps designed to be?) a proof-of-concept for how things are done by those Agencies that keep showing up in the news

It strike me that this tools works (or is perhaps designed to be?) a proof-of-concept for how things are done by those Agencies that keep showing up in the news. They will simply have (by hook-or-crook) several of the root cert private keys for the already-installed roots. There's a few dozen of them and any one will do. Just fry-up forged MITM certificates as needed. I doubt the target would even notice the tiny delay during handshake. As you say, no one checks fingerprints. I think fingerprints would only help if you had visited the site before without a MITM, and your SSL layer flagged changes under ALL circumstances, remembering the fried-up MITM cert will look 100% legit. I wonder if there is a privacy-protecting way to share certs/ids to detect these changes? (or is there one already?)