SSL protects against such an adversary only if the creator of the certificate is not compromised. While I think this is a reasonably safe assumption, there are still vectors for an attack. For example, if a government agency wanted to conduct an MITM attack, they could compel the CA to create a valid certificate.
Right, but the source subnet is presumably a more useful position from which to perform a MITM when the goal is connecting a physical person/device to their "anonymous" online behaviour.