Something similar has also been my thought re: Internet providers forcing TLS root certs on you to MITM you. Even if, at some dystopian point in the future, ISPs stop allowing traffic they can&#x27;t MITM through their networks, you <i>can</i> always accept their root cert into your OS&#x27;s TLS stack... and then just turn around and:<p>1. configure your browser to use a separate CA store from the OS one;<p>2. set up a VPN tunnel to a jumping-off-point not within your ISP&#x27;s reach;<p>3. hide that tunnel&#x27;s traffic steganographically within a regular &quot;encrypted but actually MITMed&quot; connection to your VPN server.<p>These three steps could even be put together into a little middlebox to put between your home router and the Internet, so each device could keep its OS-level CA store sane, while still appearing to the ISP that everything is regular MITM-able traffic.