Having the private key of a trusted root CA lets you create leaf certificates (or intermediate CAs) that your computer will trust implicitly (because the root is trusted). This would allow someone to man-in-the-middle your connection to, say, gmail (with help of your ISP) and you would not be able to easily detect it.
Gibson Research Corporation created a page that shows the real signature for some common websites (and lets you check any site you want). You can then connect to them and view the signature in your browser and compare them. This is what you would have to do to know if you were being MITMed with a "real" certificate.
https://www.grc.com/fingerprints.htm