That would mean they've broken TLS which, whatever powers the NSA supposedly has, seems unlikely.

I don't think they would be intercepting SSL traffic either, because Google has a hard enough time legitimately updating their certificates [1] that I imagine if the government were doing it on a wide scale people would definitely notice.

[1]: http://googleonlinesecurity.blogspot.com.au/2013/05/changes-...

Without the key, they couldn't read it. Getting a CA on board doesn't give them that (that would only allow them to create an alternative key that software without pinning would accept), they would need to either be given the key by anyone that had it or factor it themselves.