I wonder about one thing, if somebody can perform MITM on arbitrary domains, is there something like certificate pinning to stop impersonating the authorities used for things like this? I remember OCSP being something like that (if I’m not butchering the initialism), where the browser requests confirmation the certificate is currently valid, and the server can pre-fetch this confirmation to send to the client.