They have low-tech means of circumventing the filter, mostly involving spending an hour going through page after page on google until they find a site not blocked.
Hardly low tech!
I too work in a school, which also implements all sorts of paranoid filtering on the school LAN. (Don't know about root CA certificates, I've never looked.)
Increasingly however, what the school does is utterly irrelevant. Almost all the students have their own completely independent access to the big bad 'net. They have phones with full Internet access, dongles for their laptops, and even laptops with SIMs built in.
It'll be a while before school authorities recognise that they're standing with their fingers in the tiny remains of a dyke, the rest of which has long since been washed away by the incoming tide. Until then, we'll still find ourselves unable to access all sorts of random and silly things in the classroom. I was refused access to the text of Rudyard Kipling's "If" the other day.