[drpossum]

Or anyone who controls your DNS resolution which has a number of paths (for example a local hosts file, possibly a router, changing your config or how you get your config to a malicious DNS server, etc)

[eknkc]

Won’t work with https.

If that malicious actor can install a custom ca too, they can already install whatever spyware they want.

[q3k]

Not that easy with HSTS.

[wbl]

Also need a cert which is tricky

[ruined]

or public wifi access point

[abirch]

You'd probably need DNS and Root Certificates, something to which most employers have access