Well thats an intersting thing with high availability no? If you do TLs termination at the load balancer you can easily use any certificate down the line that

Well thats an intersting thing with high availability no? If you do TLs termination at the load balancer you can easily use any certificate down the line that you would like and thus this is a Feature. I think the general gist of "i am connected to a server that I trust" is a mood point in general if you do not control the network that you are on. All you can really make sure is that your outgoing packet contains a desired destination. I liked what mega and others have done, encrypting the data in the browser before sending it across the wire. Its an additional step but it almost solves the problem. The way i solve this for me is to use a direct wireguard connected jump host in the cloud and a router at home that uses openwrt and at least can be checked completely.