UserAgent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_3) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/55.0.2883.95 Safari/537.36

Steps to reproduce the problem:
1. GoTo https://www.euprava.gov.rs (service to fill tax reports, get personal documents etc..)
2. Browser will reports Secure Connection
3. In fact this is misleading, as GB Law differs from Serbian.
4. No .gov website secured by a foreign SSL issuer that is not legally incorporated in the country (therefore not liable) should be able to display secure connection. It is not.

What is the expected behavior?
No Browser should report secure connection under this specific circumstances.

CA/Browser forum is slow, and someone needs to push this into discussion.

What went wrong?
I have raised a serious security issue in regards to browser trust behavior within countries who don't have specific set of laws and regulations yet, but using foreign SSL authorities to secure GOV (Government domains).

Those SSL Authorities are not legally incorporated within the territory and do not require to meet local regulations of citizen data protection.

Presenting connection as secure for services that Citizen use to fill tax reports, even sign up children to a Kindergarten is misleading and open up a privacy issue, since theoretically another country (of the issuer) may exploit the data in accordance with their local laws that might differ from local.

In personal opinion, no government service (.gov domain) of any country should be presented as Secure in any browser, unless certification body is legally incorporated at the territory. 

There is a case study in regards to Republic of Serbia situation at: https://www.certic.info/serbiaitcapitulation.php i created minutes after discovering that the service used to transmit most sensitive data, (including personal ID keys) is secured by Comodo, who has no local legal incorporation and holds no liability.

For example, Serbian law requires any form of agreement to be written in the presence of 2 witnesses, therefore buying SSL from the web makes no legal ground for any action against issuer in case of abuse. 

This is something that requires a strong debate within internet community, especially within countries affected.

Please discuss your opinion, the strength of impact and ideas on how to address this.

Did this work before? No 

Chrome version: 55.0.2883.95  Channel: n/a
OS Version: OS X 10.12.3
Flash Version: Shockwave Flash 24.0 r0

This is tricky, and probably affect large population.