Thanks for the info! I didn&#x27;t know some of this. Two questions:<p>1:<p>&gt; there is a very real possibility of that certificate being blacklisted by browsers<p>Why would a browser blacklist a certificate? Is it possible for a browser to detect a MITM attack when the SSL traffic is all signed by the private key of a trusted root certificate?<p>2:<p>&gt; Further, unlike the Kazakhstan certificate, those root certificates cannot bypass HTTPS public key pinning (HPKP).<p>You are saying that pre-installed root certificates behave differently than user-installed root certificates? Wouldn&#x27;t that behavior be system-dependent? I was under the impression that <i>no</i> root certificates can bypass public key pinning... isn&#x27;t that sort of the point of pinning? That it allows traffic encryption outside of the normal trust hierarchy? What makes the Kazakhstan cert special that allows it to break pinning?