You can do this with the VpnService API, and there are multiple apps that do this for you. Example (not an endorsement — do your own research): https://github.com/x-falcon/Virtual-Hosts

I've long thought about setting up a service that people can connect to with their mobiles or other devices (who don't want or can't root) that basically sanitizes their connection: strips out ads, beacons, tracking cookies, etc.

Or, set up virtual desktops that people can connect to that also use VPNs that could allow people to originate their traffic from a given region.

I'm primarily interested in created a sanitized stream more than anything. People have a right to surf without being tracked.

you'd need them to install a custom root cert if you wanted to MITM their secure traffic, and still wouldn't be able to do much with any app or service that pins or bundles its own certs without going through PKI system though?

I guess you could just block that traffic and let people deal with the breakage, maybe. I wonder how common it actually is.

I think you can use DNS66 for WiFi and LTE. It creates a VPN, which is really just a local proxy that you have on all the time. All traffic goes thru it.

Shoutout to this service - from what I can tell it is the least concerning of several options in terms of data leakage and trust. At the least, it seems to work after testing several domains blacklisted through Steven Black's host file on Github.

I wish root were easier to get on my own damn phone

Agreed. I don't mind the requirement of root, just as I'm glad my desktop has a root account that's not the default account. That said, the effort required to obtain root on my own device is silly. It should simply be a switch in the "Dev Tools" settings screen, which is already hidden from plain consumers.