In that case it was ssh sessions being intercepted.
But my question is if a tor exit node or a vpn provider or your internet provider has a private key to any CA then can they mitm any normal web traffic even though it will show up as https without warnings in your browser?
Browsers will demand for modern certificates that they're accompanied by SCTs which indicate the certificates have been logged publicly. Certificates signed locally by an attacker aren't and the revoked CA certs should be immediately rejected by the CT providers.
If the attacker has the key before disclosure, Google.com appearing in the CT logs would immediately set off alarm bells. If it doesn't get a CT log entry, browsers reject the certificate.
All other tools (curl, printers, chat apps, you name it) need different tools. Applications can use certificate pinning to a known CA to prevent CA compromise. Generic tools will not have an obvious recourse.
When you're using a modern browser that browser will require any certificate to have a certificate transparency log stamp. Certificate Transparency logs are public append only logs of issued certificates.
So you access example.org. Your ISP uses the compromised CA certificate to create and sign a rogue certificate for example.org. It now has to submit this certificate to a public certificate transparency log and gets back a proof for that. Now it can use that rogue certificate and the proof that it's in a CT log to impersonate example.org and MITM your traffic.
CT does not prevent compromise, but it makes it far easier to detect. If the people behind example.org have a look at the CT logs they will see the rogue certificate there that they did not request. This makes rogue certificates and by extension CA compromise detectable. So your ISP cannot just do this forever in secret.