Regarding your first question: The answer hinges on the definition of "transparent". To me, transparent interception would imply that no certificates or certificate authorities have to be manually added by clients to the "trust store" of their devices. As long as this condition holds and your browser correctly checks the presented certificate for its validity, an attacker will not be able to intercept your connection, unless they manage to do one of the following:
- compromise one of the CAs your device trusts
- somehow get a trusted CA to sign a counterfeit certificate for a site they do not actually own
- manipulate the trust store on your device
- or get hold of a specific server's private key.
The reason why these are the only attack vectors (again, if the validity check is properly implemented client-side) is that the server will present a certificate (including the server's public key) that is itself signed with some CA's private key. The client checks whether the signature matches with the public key it has stored for the corresponding CA, and if it does, starts a TLS/SSL handshake with the server. It is at one point of this handshake protocol that the client encrypts some connection-specific information with the server's public key. Whoever is intercepting the message will then have to decrypt the information with the server's private key and send it back to prove they are not, in fact, someone else.
Regarding your second question, I do not know what exactly is meant in the sentence you quoted. What I know is that all popular modern browsers do correctly validate certificates. There is, however, another interesting mechanism in regards to certificate security that is not adopted by all modern browsers, at least as far as I know. Public Key Pinning is a concept related to trust on first use : When you first visit a website, you "pin" the public key you were shown to that domain and check whether it is still the same on subsequent visits to the page. This protects against attack scenarios 1 and 2 outlined above - you do no longer have to worry about fake certificates being issued if only you saw the legitimate certificate once before. Public key pinning can not only be done for specific servers but for any CA in the chain of trust. To answer your actual question, Chrome and Firefox are able to do public key pinning (and there are probably others, but I do not know every single one of them).