What's your threat model? Without loss of generality, China has a) gotten secret keys to a large pool of targets, b) those targets re-key their certs, c) China re-uses old keys to MITM those targets and nobody notices?

If so, great news! We don't have to worry about it because China can also just ask their friendly government-owned CA to generate valid certs for any MITM targets who don't implement certificate pinning in the browser also produced by their company.