Google: Maintaining digital certificate security

Indeed, plenty of unscrupulous people would rather like to be the Superfish in their own little pond.

I think that's just security through obscurity. It should be possible with a few clicks to add new certificates and set up a MITM proxy, so that the risks are more widely understood. A tamper-proof Firefox is not possible without locking down the whole system - though that may yet prove to be an answer. (I can imagine your phone not allowing you to install different certs, or replace the browser code, without going into 'developer mode' which flashes a big red warning. So then if you are using a name-brand phone you bought new from the shop, you have some confidence it can communicate securely. If (a big if) you trust the phone maker, that is...)

So above (637615) you are saying, that you support the right of the employer to intercept (I don't by the way) ... but it should be made as hard as possible?

Unfortunately, the employer will just stay with IE in this case. Not installing Firefox is certainly easier than rolling it out *and* fudging one or more certificates into its trusted store.

Maybe a better way is to make adding a MITM cert easier, but show a different visual cue in the "security indicator" next to the URL. Example:

Padlock: we're pretty sure nobody can listen in
Stethoscope: someone is watching your decrypted traffic, ostensibly for malware, but insulting your boss or planning a coup is probably not a good idea either
Megaphone: only politeness protects you, don't do anything you wouldn't do in the cafeteria