The real bad guys can just use symmetric encryption, with keys distributed by mail or by hashing parts of certain books. It's the typical end-user going to their banking site or reading their email that's most vulnerable to such devices. China might be a top customer.
Public-key encryption (such as PGP) would work as well.
Or rather Off-the-record messaging: You do not want deniability, and not leave provable traces.
If the real bad guys are smart, they're just going to use SSL, with a single static private CA.