Because your client (generally a browser) is configured to implicitly trust a group of companies called "root Certificate Authorities" (root CAs). Now, consider

Because your client (generally a browser) is configured to implicitly trust a group of companies called "root Certificate Authorities" (root CAs). Now, consider one such company head-quartered in China, or the US. The governments of both countries have the power to secretly demand such a company's keys, then use them to make your client trust whichever endpoint they chose.