Hacker News Reader

It wouldn't be particuarly hard for avast to operate this system without having the key for the CA leaving your machine.

That won't help when they send part of the plaintext home. Which any antivirus program does from time to time

It might not be hard for them to do it, but how is the end user meant to know to ask if they do?