We're already there. There are already ISPs in some parts of the world redirecting DNS queries to any DNS server to the ISP's DNS server, which gives invalid re

We're already there. There are already ISPs in some parts of the world redirecting DNS queries to any DNS server to the ISP's DNS server, which gives invalid responses to queries that authenticate the DNS server (DNSCurve) or invalid responses to queries it can read and wants to block (DNSSEC), either of which is an effective denial of service attack. Which drives adoption of ugly DoH. The root problem where the centralization comes in (because you could actually do DoH to something that isn't Cloudflare), is that you need to trust someone to faithfully and completely answer all of your DNS queries without dropping any of them or sending invalid responses for queries they don't like. That used to be your ISP, and we had a decentralized solution as long as the ISPs would faithfully answer all queries, but what happens when they don't? You need someone else. "Let everyone choose for themselves" is a theoretical answer, but in practice the average person doesn't know anybody who runs a public recursive DNS server, and Google and Cloudflare are easy and "free", so everybody will end up on them. To prevent that we need ISPs to stop interfering with DNS.