[landgenoot]

>This enables the government of any EU member state to issue website certificates for interception and surveillance

Wouldn't this be very easy to identify?

[Dumble]

The government would be able to obtain a certificate identical to the one of the a website owner (the real one), enabling the mitm attack (for example with the help of ISPs etc).

[landgenoot]

Yes, but you will see that the certificate authority suddenly switches to the Hungarian government, while reading an article.

[Urd-]

How would they get the private key? Or would this CA only allow using certs with private keys they generated instead of using CSRs?

[ulrikrasmussen]

Wouldn't Certificate Transparency make it very visible and obvious if they did that?

[Avamander]

CT would not be allowed if ETSI does not allow it. Neither would distrusting that mis-issuing CA be allowed.