The NSA doesn't need a root certificate installed on your computer if they already have the private keys to the root and/or intermediate CA providers.