I addressed this in my response. You're right that redirection does little more than just blocking the traffic, on account of the certificate check, but if the

I addressed this in my response. You're right that redirection does little more than just blocking the traffic, on account of the certificate check, but if the attacker can force a fallback to regular DNS, that's a problem.