We are told that the roots of trust in the PKI are the handful of Certificate Authorities that issue root certificates and sign other certificates and ensure at least some extent of trust to be maintained on the internet.
These root certificates come pre-installed on most modern operating systems. This provokes the thought that it is not the root CA that we're trusting, but the entity/entities that provide us that root CA, which may be the manufacturer, the operating system developer, or even the seller that sold the device.
To explain my point, I provide this hypothetical example. Let's say that Julian Assange, while hiding in the Ecuadorian embassy, decides to buy a new Thinkpad on
a famous e-commerce website. Now
famous e-commerce website, like countless other American organizations, collaborates with the NSA on data sharing. The NSA learns of Assange buying a new laptop, and decides to "bug" that laptop with a fake root CA (and a bugged TPM). The package is delivered in brand new condition, and Assange begins to use his laptop.
It turns out that the Ecuadorian embassy's network was 'pwned' by the NSA long ago. Assange's network traffic was going through NSA's systems for quite a while, but the saving grace was that the traffic was at least encrypted. Now, with the fake root CA, the NSA is successfully able to mount a Man in the Middle attack, being able to see the traffic in plaintext, with perhaps the exception of PGP encrypted e-mails.
Even if Assange tries to download new Root Certificates to ensure being on the safe side, the traffic is intercepted by the NSA, and fake certificates are inserted.
Now, you might reasonably argue that the aforementioned 3-letter-agency (and its equivalents everywhere) do not have enough funds, reasons, or legal authority to target most of us, but this might be a realistic scenario for many of the activists, or perhaps very lucrative targets such as data centers/companies that might end up buying a system bugged with fake root CA.
My question is, what are some guidelines that individuals and organizations can follow to ensure they don't become a target of such an attack?
Additionally, are there any books, research papers, etc, that discuss this threat model in detail?