This seems like the kind of thing that the USA will explicitly grant an exception to.
It is clearly bad if the whole of Iran gets their own CA infrastructure which the NSA can't as easily spy on.
Yeah now the NSA only contains the code of the browsers Iranians use, right down to the os and even firmware. Clearly a big loss ...
I guess you could say a loss is a loss ...
They could stand up their own version of Let's Encrypt with less than 20 people and $5M/year. It is inevitable. Let's Encrypt had a budget of $3.6M and 13 employees as of 2019 [1], but I don't have recent funding and staff figures as of this comment (replies with context welcome!). Probably spread the cost across the BRICS to make it US sanction resistant.
[1] https://news.ycombinator.com/item?id=24085559 (citations)