This is a really, really dumb way of doing online spying (presumably, you mean by running a program of deliberate misissuance) since every cert they issue is recorded in a public cryptographic ledger.

I'm not saying this will never happen, just that rolling out a dramatic infrastructure change for "data sovereignty" just to pull off a SIGINT heist that is almost certain to get your CA distrusted seems like a poor risk/reward calculation. I fully expect IC agencies to get some CAs killed and be fine with that.