I think saying it "doesn't address" these threats is a bit extreme. It significantly reduces the attack surface (Certificate Authorities vs every ISP), it make

I think saying it "doesn't address" these threats is a bit extreme. It significantly reduces the attack surface (Certificate Authorities vs every ISP), it makes it a lot harder for state actors to pull off those attacks deniably with a gag order, and it makes it a lot easier for an informed but non-expert consumer to pick a secure-by-default solution.