Everyone thinks they're working toward tamper proof connections for the benefit of users, but it's really for the ad companies IMO.

And manufacturers. I tried to install system-wide cert on my Android to intercept and see exactly what system apps on my old Nokia phone were sending to Chinese servers but couldn't because Google thoughtfully "protects" its users. Tivoization at its worst.

jup, I am concerned as well.

cloudflare DOH fortunately uses it own domain for dns, so you can block it at firewall level.

Google could be evil and make resolver "google.com", so you would have to block whole google.

I was talking to a few people, of creating a list of all public doh servers, so we could all use it on our firewalls to block them.

That doesn't help if ad companies and other attackers set up their own DoH resolvers.