Comment by MarkusWandel

Actually, absent a full chain-of-trust from boot, which I believe Android/iOS do provide, and possibly the proprietary desktop environments can provide, it should be possible to fake the "I'm a legitimate browser" exchange. Which is what the 1% that care will do. But it sucks to have to go to deep underground "crack" type stuff where before there was an open web. Not to mention the risk of getting hit by the banhammer if detected.