I don't seem to understand the whole thing. To me the premises are: 1) we can't trust ISP with unencrypted DNS query 2) we can trust a third party with DNS qu

I don't seem to understand the whole thing. To me the premises are: 1) we can't trust ISP with unencrypted DNS query 2) we can trust a third party with DNS query because those are encrypted. My questions are: - Why is 1 true? What are ISP doing with unencrypted DNS queries apart from knowing browsing habits? - With DoH do they not know your browsing habit anymore? - If there is a possible mitm attack with unencrypted, would it be fine if the ISP themselves ran a DoH server? - For the 3rd party: why would a 3rd party want to run a dns server for free? ISP run DNS server but customers pay a bill to them precisely to do things like this. in other words, in the long term, wouldn't it be a money sink for Cloudflare to run a DoH server? - Instead of just one DoH endpoint, could browsers take a list of DoH servers, and picking the best one in terms of p95 latency, with some round-robbin tries occasionally to verify if anything changes? This would solve the issue of one of the DoH service "having a bad day". Some amount of centralization would remain but based on an objective criteria (latency). (The article answers some of those questions and/or points out the same concerns)