&#62; It is vanishingly unlikely [...] China [...] has the key associated with Verisign's root CA certificate.<p>Sure.  I'll give you this.<p>&#62; It is almost the case that it's worth pruning out certs from your browser from untrustworthy CAs;<p>This was my point.  So you trust VeriSign, but do you trust the others (there are 125 in my list)?<p>Here's one:<p><pre><code>     Issuer: C=TW, O=Government Root Certification Authority
</code></pre>
That looks like the Taiwanese government to me.  If they have one you don't think that US has one?