https://atlas.ripe.net/frames/measurements/28334941/#!probes is showing you that, for a v4 connection to twitter.com, probe 6745 is getting back a TLS cert which does not match the cert provided to the majority of other probes.

If you expand the row you can see the nation state MitM: notice the O=ISCA, C=KZ.

> So what’s the point? If you don’t trust the certificate you won’t be able to browse the internet at all.

If all the major browser vendors do this it makes Kazakhstan's position quite difficult.

The point is that if browsers block the cert it will make the MITM impossible without them releasing thieir own browser. It will be much more clear for normal uaers that the custom browser can intercept internet traffic than that "security certificate". Also good luck getting that browser into the AppStore and PlayStore or making users install the apk.

I think it's either consciously let users to browse the Web over HTTPS and see green locks everywhere while effectively being MITM’d (undermining the point of encrypted connection), or ban each compromised certificate (making the Web difficult or impossible to access for folks in this situation).

The remaining alternative is not defaulting to HTTPS for cases like non-sensitive static sites, which would be an unpopular proposition with some objective downsides.