One does not need to break the cyphers if one can obtain the decryption key, either by locating them, or "enhanced interrogation techniques" them out of biological systems.
Neither of which enable mass surveillance though, which is the major threat from what I can tell. Rubber-hose cryptanalysis has been possible since the Caesar cipher.
If there were hundreds of millions of sites to compromise, I agree. But if one obtains, and keeps obtaining, Google, Facebook, Microsoft, and Yahoo private certificates, then one can access the private information of billions of people.
