So, the original statement that companies like AT&T can trivially get root certificates and MITM TLS traffic is just crazy talk, and you were right to challenge

So, the original statement that companies like AT&T can trivially get root certificates and MITM TLS traffic is just crazy talk, and you were right to challenge that. > The most they can do now is spy on your DNS and redirect unresolved domains to some ad-filled page. But this isn't really true either. There's a lot more that can be done with a packet stream than spy on DNS, even if the actual payload traffic is encrypted. A combination of DNS, SNI, IPs, and packet sizes and transmission patterns can allow fairly granular classification of traffic by type, and specific connections can then be traffic-shaped, e.g. by explicit throttling to some target bitrate or by applying differential QoS to them.