Thanks for mentioning your Streisand server. I had no idea this existed. This is amazing!

Here is the GitHub repository if other people are interested: https://github.com/jlund/streisand

The reason for that warning is the fact that when you add a certificate that is not trusted by Android, it goes into the personal cert store. When you add a cert in the personal cert store, the system requires a higher security level to unlock the device. hence the warning and pin/password nag.

But if you manage to add your cert to the global system store then Android will not issue any warning. Here's how to do it:

1 - add your cert normally, it will be stored in your personal store and Android will ask you a pin/password.

2 - With a file manager which has root access, browse to /data/misc/keychain/cacerts-added. You should see a file there. This is the certificate you just added at step 1.

3 - Move this file to /system/etc/security/cacerts

4 - Reboot the phone

5 - Now you can clear the pin/password you have set to unlock the device and there are no warnings.

I won't recommend doing this blindly as by doing this, you are actually man-in-the-middling yourself. But if you know what you are doing, this is the way.

Yeah, and that's even more stupid if your threat model considers your country and ISP as an adversary. We don't all live in nice countries, and in this case not having a VPN is far worse in terms of traffic interception than having your Streisand or similar. I guess Android developers are only aware of suspicious VPN providers and do not even provide an option to reverse this warning banner.