Certificates can be invalidated after-the-fact using certificate revocation. But bear in mind that this simply tells the browser (if the browser actually asks) that the certificate is no longer considered secure.
As far as issuing invalid certificates, while theoretically possible, you have to bear in mind that the very first thing any admin does after installing a certificate is test it -- if it isn't valid he wouldn't use it.
Also, note that the security of the communication is not a function of the certificate. The certificate only certifies that the owner of the domain is in possession of the corresponding private key associated with the public key embedded in the certificate. At no point does the CA ever see the private key or any other information that isn't already public.
All the details relating to the security of the communication between the browser and server are negotiated on-the-spot between the browser and the server.
The CA can issue additional certificates claiming to correspond to your domain for which the private key belongs to the Government rather than to you. And in that case it can be used for a man-in-the-middle attack. But the Government doesn't need the cooperation of your CA, they can go to any CA that the browser trusts to get their phony certificate.
Some corporations install their own CA certificate onto company-owned computers so that they can perform man-in-the-middle attacks on all outbound SSL traffic for the purpose of content inspection. If your CA certificate is trusted by computers by default, then you could do this globally.