That would work right up to the point where the server returns a certificate that the client needs to validate. If you're an attacker then you'd also need to h

That would work right up to the point where the server returns a certificate that the client needs to validate. If you're an attacker then you'd also need to have a certificate with a matching domain and is signed by a trusted certificate authority. Otherwise the client will see the certificate as untrusted. Having a trusted certificate for a domain you don't own is already the "Game Over" scenario for current TLS connections since DNS hijacking is generally much easier.