You mean nasty root certificates like VeriSign and GoDaddy, which the NSA frequently uses for MitM?

You should do the same to those certificates that you did to TURKTRUST, just throw the US CAs out.

    VeriSign and GoDaddy, which the NSA frequently uses for MitM?

Link?

Snowden, 2013?

Actual link? I don't remember reading this in any of the leaked documents and I can't find it now, though I could have missed it.