Blaze: The Spy in the Middle

If I were betting, the most likely certificates to be forged would be the ones for "anonymous proxies", or for sites dealing in illicit videos. For most of the sites people typically visit, either the government already has access via warrants, or the site is "uninteresting", although the definition of uninteresting may vary by government. These sites may not get enough attention for anyone to notice a changed certificate.