The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from...
Everyone who can read your unencrypted traffic has the possibility to intercept your encrypted stuff. So it is really not that hard.
But you don’t seem to be bothered too much about that possibility. So lets agree to disagree.