There will be documentary evidence if a nation-state actor uses a bogus SSL certificate, yes.  Whether anyone will <i>keep</i> said evidence -- do you keep long-term copies of every SSL certificate you see for www.google.com? -- is a different matter, especially since a smart attacker (which we presume nation-state actors are) is likely to be selective in their targets.