Yes, but only on the first visit. In comparison, TLS could be MITM'ed in each individual visit by a localized adversary as long as their location includes a CA

Yes, but only on the first visit. In comparison, TLS could be MITM'ed in each individual visit by a localized adversary as long as their location includes a CA you trust - which appears to be the case for every intelligence agency out there. Which threat model you prefer to deal with is up to you.