Again - who cares about dns cache poisoning when your cert chain is sound and your browser is sensible about cert downgrades (which all of them are now)? Who cares about how secure the AP is? It’s an encrypted, securely authenticated connection. That’s the whole point of the cert chain. The AP can be as malicious and evil as it wants - good luck usefully tampering with or impersonating my bank’s public key.

Again, what’s the threat model here? Exploiting a browser vulnerability? Maybe?