Sure, adding additional trusted entities isn't ideal, I'll grant you that; all other things equal, I'd prefer not having to trust CloudFlare in addition to the

Sure, adding additional trusted entities isn't ideal, I'll grant you that; all other things equal, I'd prefer not having to trust CloudFlare in addition to the local network, etc. But the list at the end feels a bit defeatist: >1. Completely shut down plaintext HTTP >2. Use encrypted DNS >3. Deploy functional and downgrade-proof encrypted SNI These seem like laudable goals to me. (Though is it actually necessary to completely shut down plaintext HTTP? HSTS preload gets you there on a per-domain basis, right?) >4. Disable OCSP/make OCSP stapling mandatory, or replacing it by an alternate mechanism So... if OCSP doesn't encrypt its requests right now, fine. But fundamentally, if you have a cert from LetsEncrypt, and you want to ask LE whether or not that cert has been revoked, is there any reason that request can't be encrypted? It seems generally tractable. >5. Host everything (every last widget) on large content distribution networks that are able to provide generic IP addresses, that have no discoverable link to the sites they are hosting This one is difficult, yes, but I don't think this is the only solution. Couldn't something like Tor's onion routing also do the trick? (You can use onion URLs of course, but they're not memorable - a DNS record pointing to an onion name could be.) And after all this, who's to say you have to use CloudFlare as your DoH provider? Pick one you trust.