I've seen that, but I didn't see much of a mitigation, though I'll go back and recheck just to be sure, I was pressed for time last time I look at that. In fai

I've seen that, but I didn't see much of a mitigation, though I'll go back and recheck just to be sure, I was pressed for time last time I look at that. In fairness, most of big tech are AS-level adversaries at this point. Active attack through BGP-hijacking may be partially mitigated, but this isn't really needed for the most pernicious attacks which are interception/injection from a regional entity that's routing to the broader internet (outbound connections). The same entities can do early transparent encryption termination for outbound connections (to the general web) since they have their own private signing keys tied to root trust CAs (just not the one the valid cert was issued to), and that lets them collect a treasure trove of forensic artifacts to improve their citizen dossier for advertisers/highest-bidder, or inject content that is ephemeral in nature.