You need root access on the machine to add an SSL cert, meaning that the network level filter fails without maintaining control of the users machine. At that p

You need root access on the machine to add an SSL cert, meaning that the network level filter fails without maintaining control of the users machine. At that point you may as well do filtering at the client level. I think we can all agree that breaking SSL is bad.