[quesera]

> intercept the DNS requests and serve your filtered stuff.

How do you get from a malicious DNS response to a browser-validated TLS cert for the requested host?