At my work all browsers have a custom root CA installed, which then allows them to snoop on all https traffic while the users get the false impression that they are browsing a secure https page.
Why are browsers allowing such easy defeat of https, and not warning the user about it?
EDIT: Based on the answers/comments I realize that I was perhaps incorrectly emphasizing the wrong part of my confusion. I understand that there are some legitimate needs to want to change the CA list, what I don't understand is why you wouldn't want to warn the user if such a change has been made. Doesn't not warning the user defeat the point of the green box next to the address? Do I really need to go through multiple clicks, and then perhaps do a (compromised) search to figure out if the root CA is a real one or not for any computer that I don't own and/or if I let someone else touch my computer?