An attack like that would also mess up the flow of the data. Me in Europe ------200 ms------- MITM magic --1 ms-- Google For the attacker not to introduce hug

An attack like that would also mess up the flow of the data. Me in Europe ------200 ms------- MITM magic --1 ms-- Google For the attacker not to introduce huge extra latency, it would need to complete the handshake with Google almost instantly. Someone would eventually notice instantaneous TLS handshakes. Also 2 separate TLS connections would contribute to bufferbloat pretty badly, and someone would also eventually investigate that.