HN user
How would that help? Tracker leads back to IP of your VM instance. Although your VM instance doesn't keep VPN logs, the VM provider would happily cough up your Name/Address/PaymentHistory in response to a court order. They wouldn't need to know your home IP address.
To expand on what aidenn0 said:
It's possible to do client-side known-public-key verification, which would detect a MITM attack. The idea is basically maintaining a local trusted cert list (other than the broad ones in the OS), but using known site public keys instead of root signing certificates (which I will admit are a security nightmare for SSL).
Chrome does this for Google-controlled domains; they call it "public key pinning." I'm not sure if any of the other major browsers do it, but it would be pretty simple to implement.
Even if the government had a root CA-signed cert for "mail.google.com", Chrome would throw an error because the government's signed cert public key would not match the public key pinned inside the Chrome browser source code. Chrome would barf with a certificate error.