This is not possible on an https connection and HSTS preloading prevents ISPs from downgrading secure connections.

In the near future: "To provide optimum security and privacy for your internet browsing, you must now install our Comcastic™ Special Magic Certificate®. Failure to install our certificate will result in browsing being restricted. If you don't like it, go to a competitor."

That's very possible. It's probably better you dont even say it publicly to avoid given them the idea. Only a few companies have to implement it for it to become a national problem.

That cat is already out of the bag. Companies already sell MitM services to companies that want to monitor and filter the web traffic of their employees.

I suspect there are already niche ISPs out there that cater to the content-blocking impulses of certain customers by doing deep-packet inspection and firewalling at the gateway.

I don't think they can break SSL in order to do that.