> take the control away from the user/network-admin You are confusing the network admin and the user. Most users have little reason to trust their router, they

> take the control away from the user/network-admin You are confusing the network admin and the user. Most users have little reason to trust their router, they often don't own it, update it or have any clue about it. Even experts change roles here when they use any other entities network. I understand your use case, but I personally think the end devices should increasingly allow interception by network devices only with user consent, not implicitly. In other words, opt-in on the device with DNS settings and certificates. If you don't own the device (e.g. have root/admin/etc), you don't get to control it - beyond blocking it.