Cert Pinning and Certificate Transparency should block the decryption, even on a VPN where the user has installed a custom root certificate. It wouldn't stop t

Cert Pinning and Certificate Transparency should block the decryption, even on a VPN where the user has installed a custom root certificate. It wouldn't stop them seeing what domains the user is going to (as it's sent in plaintext because of SNI, and ECH was still a few years away).