Still, a NSL would be enough for the government to gain the right to intercept the traffic legally.
Not quite enough. And it's not a problem of US only. I think there is some background confusion in the question, so I will be expanding a lot on the government security topic. Please remember that CAs only assess the ownership of a domain, releasing a certificates that makes your browser trust that the public key used in SSL encryption is the key owned by the rightful owner, or on the opposite that no one owning (better pwning) the communication channel from within the middle is spoofing traffic.
CAs do not secure the web, but they rather help make the web a more secure place, which means they play only a role in a complex show. They issue the equivalent of a passport to websites. So an NSL is not sufficient to intercept traffic, and most importantly we need to analyze what a government may or may not do to to intercept traffic.
First, why do we trust many CAs from USA? It is a historical/market reason. US market has grown rapidly in the hi-tech in the 90s-2000s, so it's just that plenties of companies grew to size and reliability to become trusted by browser makers (not to mention that most of them are US-based as well).
Second, what technical power does the CA to sniff or let someone sniff traffic? Since CAs do not own the private key, repeat they do not have technical power or backdoor to grab the secret key, the most they can do is to issue a certificate to a rogue entity who at the same time controls the networking infrastructure at some point between target user and site. If for example the rogue entity is a cloud provider, they have full control over all channels, while if the rogue entity is a consumer ISP they will only get traffic from their customers.
So what can actually a government do with a gag order?
That depends on location. Expect that government of France has little power to issue a gag order to sniff traffic directed to service service under investigation run by a French individual mainly serving customers from Russia using a server hosted in USA and protected by a CA based in Israel. I made the example widely complicated, because French government (replace any country name for sake of Frenchmen honorability):
- May not have jurisdiction over Israeli CA, but has power over French CAs
- May not have jurisdiction over the Russian ISPs
- May not have jurisdiction over USA cloud providers
May is ironic in such a case.
From what government are we safe?
I think this one is the key of the question, in my opinion the reason behind the whole original question. The OP provides Sweden as an example of a country with strict privacy regulation that prevents wiretapping from happening. I personally don't know Sweden regulation but my answer can be applied to any government. I am basically say that any government has power to coherce local entities (may be companies or citizens) to do action that is unwanted from them. But they may or may not have jurisdiction over foreign entities. A CA in Sweden would suffer the same threat should Swedish government start an investigation requiring wiretapping. European Union could even be the worst place for jurisdiction independence, as EU members are notably increasing their cooperation agreements. But that's another, geopolitical, story.
If the NSA did historically abuse their power to wiretap - which is legitimate when scoped to inviduals involved in serious criminal investigation and regulated by specific acts - by actually wiretapping everyone, is not part of regulatory environment. A court order is something we assume to be always acceptable. NSA was considered to be rogue by many US citizen themselves due to the impact the #datagate scandal had in the US as well
Case study: Autistici/Inventati, when you won't bother CA with a gag order
There should be plenties of similar case in history but I will detailfully describe a case occurred years ago (2004-2005) that I remember well.
Autistici/Inventati ran a public mail service designed to protect privacy of customers, in the era before Gmail reported emails received without TLS protection. This service was based in Italy serving customers from Italy. It was hosted at Aruba data center, an Italian cloud provider, on a dedicated server.
A customer of Autistici was under investigation and his mail was to be wiretapped. Italian prosecutor, considering that Autistici email provider was a self-proclaimed collective, e.g. not a commercial liable company, suspecting they had sympathy, direct involvement or intention to reveal the gag order to the party under investigation, convinced court to order Aruba cloud provider to do the following:
- Shut down the server to allow technicians to grab the SSL private key from server disk
- Lie to the customer claiming the downtime was due to a fuse break in the power cord
- Restore the server to operation without sharing details about the fact to anyone
- Provide wiretap records from the network interface
By regulation, lawsuit acts are public once investigation is over, so when the raid documentation was declassified, after a year, it was discovered that the police had then the power to read all mails at Autistici server.
One year ago the authorities (i.e. the postal police), during the investigation that led to the suspension of an email account (croceneraanarchica-at-inventati.org), shut down our server without any notice, and copied the keys necessary for the decryption of the webmail. Since then, they potentially had access to all the data on the disks, including sensible information about our users. This happened with the collaboration of Aruba, our provider.
When we noticed that the server was unreachable we repeatedly called the Aruba web farm, asking for an explanation. They made up silly excuses about technical problems, deciding that their clients, their contracts and the rights of our users weren't worth a single phone call to the server legal owners. They lied and totally disrespected even the most basic rights and the privacy of those utilising their services..
Some details here, but I have read the full story about the plug cord elsewhere. This demonstrates that CAs are not necessarily the easiest target for a gag order.
And finally, the blockchain solution
Although not part of the question, here is the proposed solution to solve the legal accountability issues of CAs.
Since the same Google is aware of the issue of rogue certificates (consider that USA, Russia and China have their own commercial CAs), they have been already researching on using the blockchain to secure the issue and revocation of SSL certificates. What blockchain basically do is to provide evidence that cannot be altered by the act of a single entity not controlling the vast majority of the infrastructure.
Here are some sources:
