Pre-Snowden, I would have dismissed this question as being in the "tinfoil hat" category.
Unfortunately, the NSA's pervasive misconduct (not to mention that of its "Five Eyes" junior partners, e.g. GCHQ, CSIS, and whatever the Australian and N.Z spook agencies are calling themselves these days), does indeed raise a troubling question.
The specific possibilities are numerous, but let's consider only two of them :
(1.) NSA could -- by asserting the USA PATRIOT Act and various other similar laws -- simply demand that a CA remit its root private encryption and signing keys. This would of course allow 100% effective masquerading by the NSA, with respect to any downstream certificate in the chain (since, the subordinate certs would appear to have been signed by the root CA's legitimate private key).
(2.) NSA could, also, install some kind of SSL interception (MiTM) box (which they are already well-known to possess) in front of the CA's root network architecture. This would allow some of the same functions as (1.) (but would be less flexible).
"Certificate pinning" can mitigate some of the risks here, but of course it would be of little use in the case of scenario (1.).
Unfortunately, what this really all goes to show is the truth of the familiar security aphorism, "if an attacker (in this case "No Such Agency") can get physical access to your box or network, it doesn't matter what security measures you may undertake; you'll be 'pwned' one way or another".
In the long run, I think the only halfway-valid mitigating step would be to only use Certificate Authorities that are :
(3.) Located outside the physical jurisdiction of the "Five Eyes" countries (as well as outside other countries whose political system cannot be trusted to respect privacy -- Russia, China, Iran, Germany, Israel, India, Pakistan, etc. spring to mind); and,
(4.) Are located in a country (or other setting) with a sufficiently sophisticated IT staffing environment so as to make them as immune as possible to subversion attempts on the part of state intelligence agencies working for the countries denominated in (3.) above; and
(5.) Are located in a network environment that is reasonably resistant to subversion on the part of the same intelligence agencies.
The problem here is, apart from the fact that the Venn diagram arising from the intersection of (3.) to (5.) above is likely to result in a very limited number of physical jurisdictions (Switzerland, maybe? I'd have said "Sweden", except for the Pirate Bay and Assange fiascoes), any CA located in this kind of setting would be a tempting target for "No Such Agency" and its partners in destroying trust on the Internet.
A CA is, by its very nature, a single point of failure in this respect, and it is only rational for a very well-resourced, unscrupulous entity like the NSA, to expend "whatever it takes" (keep in mind that the NSA's budget is already several multiples of the entire state budgets of many smaller nations), in order to be able to subvert all supposedly "secured" traffic that depends on the integrity of the CA's private keys.
So there you have it. Not particularly good news, but IMO that's an honest description of the situation as it now exists. Send all cards of thanks and appreciation to Michael Hayden, Keith Alexander, James Clapper, George Bush and Barack Obama (with their junior U.K. and other friends, along for the ride).
