[jchavannes]

They would need to MITM you. But take into account that it doesn't need to be Savitech. If Savitech was compromised, an attacker could get access to their private key.

In a sense, your security becomes dependent on the security of Savitech. I imagine their private key is not as securely stored as a real CA would store theirs. (e.g. with Superfish, Lenovo included the private key on all laptops, for anyone to grab[1])

[1] https://en.wikipedia.org/wiki/Superfish#Lenovo_security_inci...