I love how everyone is focused on the NSA and CIA as threats, to the exclusion of all other possible threats. If the US government wants to steal my credit card number, they can just tax me, that's a legitimate power they have. If they want to stop me from going somewhere, they can just arrest me at the TSA checkpoint. Setting up a MITM and breaking TLS, while possible, is way too much effort to gain something they can already gain in a perfectly straightforward way. It's like killing ants on the White House lawn by poisoning them via fracking.

The threat model for bugs in United is primarily non-governmental thieves.

What you said doesn't invalidate what I said. Are the intelligence agencies allowed to have that data at all? Because if they aren't they will try and get it using unofficial channels.