There’s a rabbit hole of what ifs one can descend down regarding this:

- what if a nation state has access to a CA

- what if a nation state creates a backdoor in TLS and the pull request gets merged

- what if a nation state creates a backdoor in your OS

- what if a nation state creates a backdoor in your hardware

All are possible but more likely is they’ll just use their influence to grab your data directly from the service providers themselves. Eg Google / Microsoft / Meta / Apple etc.

You could get around it by self hosting and using PGP but one has to ask what your personal risk is. With greater security comes greater hurdles and inconvenience