Controlling the certs doesn’t control the keys. Access to the keys is necessary to inspect the traffic. Even without government control of the root certificates, if they can access the keys, they can decrypt the traffic.

Now, controlling the certs can open you up to MITM, but that’s a risk no matter who controls the root.

abruptly discovered packages and updates no longer worked

This happens when you’re at least an entire release cycle behind and haven’t updated the archive signing keys. You need to install them, and possibly modify your sources.list to point at archive.debian.org instead. No major surgery required.