"The real power is with the OS/Browser"
"The real power is with the OS/Browser as they ultimately decide which authorities they are going to trust or not." - bingo!
And that is a weak link since the software can be dirty. I don't know how all the add-ons for Firefox, Chrome, etc. work but it wouldn't surprise me if some snooping and fiddling with message packets wouldn't be possible at that level, let alone infecting the browser itself.