In the end, DoH has to either start with some kind of seed IP address, even if it's a cache-priming DNS A record, or use a (presumably attackable) non-DoH looku

In the end, DoH has to either start with some kind of seed IP address, even if it's a cache-priming DNS A record, or use a (presumably attackable) non-DoH lookup to find its server. You can't start with a domain name for the server that you use to resolve all domain names. But I don't think that's very important, because domain names always resolve to IP addresses anyhow, and you can't change the IP addresses that fast. So you would have to share an IP address with something "too important to block". The political problem with that tends to be that the operators of things that might be too important to block tend to think that those things are too important to expose to any risk of being blocked, say by sharing them with something that somebody might want to block. It's also not always administratively or technically trivial to share the domain name or IP address(es) of some giant public Web service with another fundamentally unrelated service like DoH. I mean, sure, in the end, if enough large organizations tried hard enough, they could eventually come up with ways to make it pretty painful to block... but those large organizations tend to have overriding commercial concerns... and not to want to overtly taunt large governments...