Agree! The real spy agencies can do it smarter - signed with its own root CA, etc. It might also be other 3rd parties who is doing the MITM. Anyone can setup

Agree! The real spy agencies can do it smarter - signed with its own root CA, etc. It might also be other 3rd parties who is doing the MITM. Anyone can setup a fake free wifi, reroute the DNS system. Some percentage of those "free" service users will press "OK" to let other sniff their "secure" connections.