you could have an outer TLS tunnel that accepts the MITM certificate, then do HTTP, then a websocket upgrade then your VPN-over-websocket. Or fake pipelined HTT

you could have an outer TLS tunnel that accepts the MITM certificate, then do HTTP, then a websocket upgrade then your VPN-over-websocket. Or fake pipelined HTTP that exchanges data bidirectionally. But really, you don't have internet access at that point, so you shouldn't expect internet software to work.