Those hundreds of trusted root certificates are, at least to some extent, held to operational and security standards. If your ISP used one of those certificates to MitM your traffic, there is a very real possibility of that certificate being blacklisted by browsers.<p>Further, unlike the Kazakhstan certificate, those root certificates cannot bypass HTTPS public key pinning (HPKP).