> if you have a dictatorship, you can require that your CA remains trusted

How?

I mean, I suppose you could mandate that all computers sold in your country come preinstalled with state-approved monitoring software. But barring that, what's going to stop users from downloading the latest version of Firefox which includes code marking your CA as untrusted?