So when my browser uses TLS to access Hacker News, certs are somehow installed so that a MITM listening to the TLS handshake (like Privoxy) would not have access to them and be able to decrypt the communication?
This is why it's recommended to use a client VPN on gateways you don't own, as MITM software can be added to any server to operate the same way (though they need to obtain the private keys of certs your browser already trusts, or silently install new ones to prevent your clients from alerting you).