Wow, that's pretty crazy. I thought hijacking failed domain resolution queries was bad. Thanks, under this threat model (which I hadn't considered), ubiquitous https makes sense.