It's not that easy as just checking a box that says "enable decryption". Not saying they can't decrypt traffic, but it's not trivial if you don't have the private keys.