Hacker News Reader

As long as they can subpoena the endpoint, it's mitigated.

If they can compromise/coerce/control a root CA, then everything is largely moot.

Is it that hard for them to control the root CA? How can we verify that? Someone should probably look into it.