You're forgetting a major part. The only reason the enterprise devices can do it is because those enterprises have rolled out a trusted cert to their clients that allow the edge devices to create on the fly certificates that make the client device think they have end to end encryption.
Now.. of course.. if the NSA has a CA in their back pocket (and why wouldn't we think they do) or are a covert CA themselves (hell anyone can be a CA these days), then life is a bit easier for a man in the middle type attack. But you'd still have divert the traffic to your own servers that are using the 'fake' cert for the website in question, which would then act as a proxy for the real site (exactly like the enterprise systems).
This problem can be mostly solved by CA stapling. CA stapling can be seen here http://en.wikipedia.org/wiki/OCSP_stapling
Of course to really make this all work much more securely we need secure DNS, and I'm not sure how much longer that's going to take, if we ever get it.
