Review and compile the browser yourself, or just trust that someone would have found it by now and trust that your browser vendor knows that and would never do it in the first place unless they wanted to kill their browser instantly

The NSA doesn't need a root certificate installed on your computer if they already have the private keys to the root and/or intermediate CA providers.