They have the secret codes to MITM (intercept, inspect, alter and forge) any communication if they manage to place themselves between you and a party you trust.
> random banks and IT companies in the world holds the secret codes to everyone's encryption.
That's not true at all.
What they do have is the power to MITM connections IF they first spook DNS or insert themselves into a proxy accepted by the server somehow.
So, if you want to be honest, the original sentence becomes:
> random banks and IT companies in the world holds secret codes that are trusted by everyone to sign information that is used to establish trusted communications. If they wanted to, they could try to tamper with people's network connections and, if successful somehow, pretend to be anyone else that had used their secret codes to sign their information.
Quite a big difference, no?
I find that communicating just enough to allow the formation of an roughly accurate threat model better retains attention; and in this particular situation I was being somewhat glib to emphasize the point of how insane our PKI system is.
> IF they first spook DNS
Or arp poison, or BGP hijack, or get in-path via tenancy shenanigans... TLS exists, premised on the literal assumption that such things are possible. If your argument is that we don't need to worry about a TLS weakness because such things are hard, I'd ask why we even bother then. CA compromise is the literal worst-case in PKI-world.