EU Article 45 requires that browsers trust certificate authorities appointed by governments::The EU is poised to pass a sweeping new regulation, eIDAS 2.0. Buried deep in the text is Article 45, which returns us to the dark ages of 2011, when certificate authorities (CAs) could collaborate with governments to spy on encrypted traffic—and get away with it. Article 45 forbids browsers from…
Regarding what a browser like Firefox can do, they aren’t allowed to impose any stricter checks or requirements than what the EU’s standards body permits and they must trust them, according to these rules. That means that the warning you suggested likely wouldn’t be allowed.
As for it not happening passively, your right that it would need to be actively man in the middled. It would be fairly easy to detect but what could be done about it? The browser is required to trust it, additional checks can’t be enforced, and the CA involved wouldn’t be allowed to be distrusted without the relevant government’s permission. It then becomes a game of who blinks first, the browser vendors potentially pulling out of a country or the EU entirely or a government that for some reason thinks it’s in the right by intercepting traffic for the children, against terrorism, or whatever excuse they come up with.
Well why couldnt firefox implemwnt the check anyways and have it trigger only if the signature is valid. That way the only proof the EU would have would be if they where activly performing man in the middle. Whats the eu gonna do ban them when they catch browsers catching them spying, think of the public outrage that would cause. Think of the headline “Browser xyz banned in EU after it caught EU spying on citizen”.