Recently on Tor Talk, there was a discussion of SSL visibility appliances (https://www.bluecoat.com/products/ssl-visibility-appliance). They are able to strip out SSL transparently (good article here: http://www.zdnet.com/how-the-nsa-and-your-boss-can-intercept-and-break-ssl-7000016573/).
Are there any effective means to audit trusted CA's in browsers, so that none of these vendors are in the list? Manually reviewing every CA obviously isn't an option.
Does anyone have any good plugin suggestions, or defensive techniques?