These CAs have to follow specific rules and have external audit. MITM is prohibited by these rules: certificate authorities that participate or enable MITM are removed from root stores (example: <a href="https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DigiNotar" rel="nofollow">https:&#x2F;&#x2F;en.wikipedia.org&#x2F;wiki&#x2F;DigiNotar</a>).