This requires splicing SSL connections, which requires installing custom 3rd party root CA certificate, which in turn requires complete and unwavering trust in

This requires splicing SSL connections, which requires installing custom 3rd party root CA certificate, which in turn requires complete and unwavering trust in your filtering software vendor.