Comment by icebraining

OTOH, if they can get a CA - any CA - to cooperate, they can MITM anyone without having to break SSL.