Allright, makes sense. But does it not mean that you could basically spoof any secure connection (provided you could establish a man-in-the-middle)? Just wond

Allright, makes sense. But does it not mean that you could basically spoof any secure connection (provided you could establish a man-in-the-middle)? Just wondering, since the VPN destination is not easily verifiable: What stops you from shipping a profile tomorrow that directs traffic towards your server for online banking sites and breaking the TLS encryption using that root certificate?