If so, it'll likely be much harder to detect as Lenovo could just have Google's CA sign their cert instead of creating their own (untrusted) CA.
Which is a reminder to us all that the Certificate "Authority" system is broken..
..by design
If that had been the issue, they could have gotten the superfish certificate signed by anyone. You don't exactly need an inside man to get an SSL cert these days.