Scammers could already find a way in by using certificates or something like that.

This is way harder and much more complicated than you’re implying. You basically need a targeted campaign against you and you’d have to be the only target for a period of time.

The EU is already doing this with their government mandated Certificate Authority. The EU has precedent that it can demand any hardware or software changes for any products sold in Europe no matter how insignificant.

We’re already sliding down the slope: https://www.infosecurity-magazine.com/news/eu-eidas-face-backlash-mozilla/