They are not the only ones that can control certificates and DNS. I am not sure why you thought this was the case given it is widely documented (and occurs with some regularity) that we hear about some other country doing one or the other.

One might make the argument that most consumer hardware is not produced in the US. But it suffices to say that if Microsoft or Apple choose to obey a secret order rather than exiting a market of 300 million people, they will do so for other countries.

App Stores are subject to more than American law. For example, there isn't just a single Apple App Store. It's split up.

It is true that the NSA has uniquely easy access to say, Google and Facebook servers and so things are a little easier than just tapping all the fiber. That's precisely so many countries are gung-ho about creating their own, in-state services...so they're the ones with uniquely easy access.

But that's not "far in excess" of others, it just makes the job easier.