DarkMatter Applies for Mozilla Root Certificate

How does the NSA, CIA, etc. sign? Does Mozilla also block them or is the blocking only against those who might "cross the red line" and spy on Americans?