Certificate pinning would defeat this. Bake it into your app that you only trust a specific certificate regardless of what is in the system trust store.

Interestingly, not always. For example apple computers will intentionally ignore your pinning attempts in some cases: https://daniel.haxx.se/blog/2024/03/08/the-apple-curl-securi...

Yikes, that’s a good reason not to use the system LibreSSL or curl provided with macOS.

Cert Pinning and Certificate Transparency should block the decryption, even on a VPN where the user has installed a custom root certificate.

It wouldn't stop them seeing what domains the user is going to (as it's sent in plaintext because of SNI, and ECH was still a few years away).

The same techniques make it more difficult for a user/developer to figure out what their device is doing.