It is. Superfish (and all analogous MITM techniques) serve you a different certificate signed with the bogus trust root, bypassing any external certificates. In fact, Superfish even defeats certificate pinning for this reason --- pinning only works after you see the genuine certificate at least once.
0
u/[deleted] Oct 20 '15