What that someone probably meant to say was:
There are a lot of certificate authorities out there, which's keys can be used to generate valid certificates.
While that is true, trusted CAs are not going to be trusted quite long when they hand out certificates to be used for MITM attacks (or, for that matter, do not comply with other rules regarding certificate issuance).
I think there was a CA that signed a sub-CA about a year ago that lost it's credibility rather quickly.
Also, CAs can generate valid certificates for keys (of their choosing, theoretically), but not valid keys for an existing certificate; that is considered infeasible for certificates with acceptable properties to begin with.
The whole trust chain concept only works if you put trust in the CAs, if you don't, you may call those "master keys", but that's a massive simplification and not quite right - they cannot unlock anything, "just" be used to sign valid certificates for a MITM attack.
For additional tin foil:
If "they" have somehow obtained keys from trusted CAs, "they" can in fact do some MITM. Yet, there are some mitigation strategies, for example public key pinning, which makes this harder for regular users of a website.