[iudqnolq]

> Second date has capabilities of network eavesdropping, MiTM, and code injection

This is probably a dumb question but doesn't that require an SSL cert? Obviously the NSA can get someone to issue a cert for a domain they don't own but wouldn't that be visible?

Couldn't you have every user device log the SSL certs it sees to detect this attack? What about CT?