This article appears to have fundamental misunderstandings of how SSL and CAs work.

The danger described, which is real, of being snooped on through false certificates issued through a CA that co-operates with the government - does not have any special significance to a new free CA that it does not have to existing non-free CAs. The governments can already do this. Unless you use certificate pinning - and very few sites do, and not all browsers support it (https://projects.dm.id.lv/Public-Key-Pins_test#Browser_compatibility_test) - then *any* CA can *already* be used (if they comply) for creation of a valid certificate; it doesn't have to be the same CA that your site uses for a browser to accept it.

Also, there's no special reason why a new/free CA should be more or less likely to comply with the government than a current/non-free one. (And the article leaves unexplained why this would be).

Hence, the conclusions are just wrong. The cost of obtaining the certificate is irrelevant. The threat in regard of a state actor who can force CAs to comply for them is not changed one way or the other. For the article's conclusions to make sense, 3 things would have to hold: 1) You're using certificate pinning 2) Certificate pinning was being supported by all browsers, or at least all targeted ones, so that the threat could be detected, 3) The new free CA would have to be open to state requests for compliance whilst 4) The current paid CAs aren't.