While there are arguments to be made for and against having secure DNS infrastructure (just look up DNSSEC), I really don't think that having trusted DNS would

While there are arguments to be made for and against having secure DNS infrastructure (just look up DNSSEC), I really don't think that having trusted DNS would remotely make a browser capable of 'distinguishing a secure SSL/TLS connection from one that’s being man-in-the-middle‘d (MITM) by an actor “with a privileged network position.”' Even if you did know a trusted IP address, how do you know the packets aren't being sent by pf, or iptables, or ARP spoofing to a logging squid proxy? This almost makes me cringe as much as draft-loreto-httpbis-trusted-proxy20-01.