The simplified view given in the documentcloud link begs a question: just which CA certificate(s) is/are controlled by NSA?
Because in order to pull that MITM off, they either need to have the target service's CA - or they have the ability to fake any certificate. My guess is on the latter.
And that means at least one commonly accepted CA certificate is effectively compromised.
Afaik it is not necessary that a root CA is compromised. Sufficient would be to compromise any intermediate CA who is not on a revocation list. How to circumvent Googles certificate pinning in Chrome, I have no good idea. They would need to compromise any certificate in the chain.
Because in order to pull that MITM off, they either need to have the target service's CA - or they have the ability to fake any certificate. My guess is on the latter.
And that means at least one commonly accepted CA certificate is effectively compromised.