They use a named certificate, validated against the standard CAs. Unless the hijackers were able to get a certificate with the name 'cloudflare-dns.com.' then t

They use a named certificate, validated against the standard CAs. Unless the hijackers were able to get a certificate with the name 'cloudflare-dns.com.' then the TLS session would fail. https://developers.cloudflare.com/1.1.1.1/dns-over-tls/ https://developers.cloudflare.com/1.1.1.1/dns-over-tls/