Comment by toast0

You don't need to break TLS to do IP/domain blocking, but you can't redirect an https page unless you have an acceptable certificate.

> but they're only broken out for big investigations or secret dragnet stuff we'll find out about in five decades, if ever.

Certificate Transparency, where required, makes certificates unusable if they're not published... But that might not be enough information.