My point was at the moment of choosing they could either open the entire connection to $CONTENT or open the device (MAC address, DHCP assigned IP) up (afaik most ISPs control the router too) for traffic to those sites.

What I'm suggesting does not require abstinence from those who have the password.