I think the spirit of your comment is pure tinfoil-hat, but the letter of it is actually valid.<p>It is vanishingly unlikely --- on the level of "major diplomatic incident" --- that China (or any other government, including ours) has the key associated with Verisign's root CA certificate.<p>It is somewhat more likely (but still, I think, pretty unlikely) that one of the following could have happened:<p>* Your computer is controlled by an employer that installed a deliberately insecure certificate.<p>* Your computer is infected with malware that poisons the CA store in your browser.<p>The first scenario is just very unlikely. We work extensively on-site for Fortune 500 enterprises, in some of the highest-security environments in the world (and in some of the most idiosyncratic and crazy), and none of them require us to install bespoke certificates to access the Internet or their websites. Now, you have to find the one employer (or zero ISPs) that not only installed a custom root, but also <i>gave the keys to China</i>.<p>The second point is irrelevant. If your computer is infected with malware, there are worse things to be done to you than injecting bogus certificates.<p>It is almost the case that it's worth pruning out certs from your browser from untrustworthy CAs; unfortunately, the market for certificates has devolved to "who will give us a cert the cheapest". I wouldn't know which ones to kill. A year or so ago, pruning out untrustworthy CAs would have protected you from the MD5 problem.