I mean, yeah, just don’t do phone inspections and go straight for the wire. Poison the DNS, cut any known IP ranges, and snoop on SNI for good measure. That’s the school and enterprise way of doing it. It’s not that evil as long as you don’t use it on unconsenting civilians (see China)!