Maybe they could bypass it in Chrome, but it wouldn't make it impossible to use for anyone smart enough to set up a pihole.

The WASM code will eventually implement its own DNS analog (or use DoH with a pinned certificate). It'll all be completely opaque TLS to your Pi Hole.

Your Pi Hole is the same thing, functionally, as the tools a nation state hostile to human rights uses to filter the Internet. You'll get the same treatment that they do.

That’s when you install squid and have it do the terminating TLS. They won’t pin the certs, too many corps do this already and not to mention certificate lifetime is in the realm of leaving a browser open for weeks.

Deploying squid is not simple as deploying a PiHole.

DNS blocking is way more trivial to bypass than client-side blocking.