3 ms·

Kazakhstan already did it. All they have to do is force browsers to accept a CA that then MITMs everything.