> gmail inbox

Except it won't impact gmail unless you're accessing it through curl. The browsers already distrusted the compromised intermediates via CRL within hours of disclosure, and removed the affected root via update.

Sure practicality is always an issue. It's an issue that attackers will go to great lengths to resolve too.

What if it's the Starbucks at 1730 Pennsylvania Ave NW, Washington, DC 20006 for an extended period of time? Compounded with other security issues like password reuse...

We can always draw a line and say, "that's not practical". The assessment an attacker is likely to do is going to be "is this practical inside my budget for the value I hope to acquire?" or maybe even just "waow, lulz".

No, you have a pretty easy way of intercepting someones git credentials and repo access. Arguably more dangerous than a gmail inbox.