The big threats today in the DNS infra today are CAs, as shown recently by WoSign/Start. All an adversary needs to MITM is a temporary certificate which they f

The big threats today in the DNS infra today are CAs, as shown recently by WoSign/Start. All an adversary needs to MITM is a temporary certificate which they feed on a TUNNEL in the ISPs' network. That way only the target is served that certificate, which is disposed off after use.