Don't you think that it would be better if certificate authorities were limited to certain TLDs? For example, a company from country A limited to A's national TLD? This way even if they are ordered to produce a fake certificate, they can only decrypt traffic for country A's sites.
Also browsers should display a warning when a certificate issuer for a website changes.
Also browsers should display a warning when a certificate issuer for a website changes.