Let's assume Alice is an employee of the Chuck company.
Alice likes to communicate with Bob, a server somewhere in the internet. Chuck, being a security orientated company, inspects all TLS connections from its devices by decrypting the traffic.
Is there any way for Alice to establish a secure connection to Bob with a device managed by Chuck without the chance of Chuck decrypting it?
Is there even a way for Alice to notice the TLS inspection?
As the certificates are trusted, Chuck could theoretically even spoof a VeriSign certificate, correct?
Let's assume that Chuck doesn't provide its devices with any endpoint software, keyloggers or similar and that Alice can't remove the provided cert. Let's also assume, that as in many companies ports except 443 and 80 are closed for communication.