My point was this can be done on any network you join... a coffee shop, a coworking space, etc (unless your using encrypted VPNed obviously) so not just your ha

My point was this can be done on any network you join... a coffee shop, a coworking space, etc (unless your using encrypted VPNed obviously) so not just your hardware. Additionally, any network along the way can inspect unencrypted packets not just your ISP. Unless your ISP is just one hop from the DNS server you're using (or you use your ISPs DNS). You are trusting potentially dozens of parties... some of whom you have a contract with any many you don't and some of whom may be a malicious government (depending on where in the world you are). But I do agree with, implicitly, what you are saying. I wish the default wasn't Cloudflare and if you change it explicitly it sounds like the canary won't work anyway.