Draft: draft-hall-censorship-tech

Commentary: From  : 
 Should n't the CA / cert hierarchy be a point of control ? For example ,  is requiring users to install their CA , to allow them to MITM all traffic : Another example of CA abuse is ROA whacking , RPKI manipulation , etc . : 
 Also got this feedback from   :
Internet Backbone: If a censor controls the gateways into a
region, they can filter undesirable traffic that is traveling into
and out of the region by sniffing and mirroring at the relevant
exchange points.  Censorship at this point-of-control is most
effective at controlling the flow of information between a region
and the rest of the Internet, but is ineffective at identifying
content traveling between the users within a region.
Internet Service Providers: Internet Service Providers are perhaps
the most natural point-of-control.  They have a benefit of being
easily enumerable by a censor paired with the ability to identify
the regional and international traffic of all their users.  The
censor's filtration mechanisms can be placed on an ISP via
governmental mandates, ownership, or voluntary/coercive influence.
Internet Backbone: If a censor controls the gateways into a
region, they can filter undesirable traffic that is traveling into
and out of the region by sniffing and mirroring at the relevant
exchange points.  Censorship at this point of control is most
effective at controlling the flow of information between a region
and the rest of the Internet, but is ineffective at identifying
content traveling between the users within a region.
Internet Service Providers: Internet Service Providers are perhaps
the most natural point of control.  They have a benefit of being
easily enumerable by a censor paired with the ability to identify
the regional and international traffic of all their users.  The
censor's filtration mechanisms can be placed on an ISP via
governmental mandates, ownership, or voluntary/coercive influence.
Certificate Authorities: Authorities that issue cryptographically
secured resources can be a significant point of control.
Certificate Authorities that issue certificates to domain holders
for TLS/HTTPS or Regional/Local Internet Registries that issue
Route Origination Authorizations to BGP operators can be forced to
issue rogue certificates that may allow compromises in
confidentiatlity guarantees - allowing censorship software to
engage in identification and interference where not possible
before - or integrity degrees - allowing, for example, adversarial
routing of traffic.
As Domain Names are resolved recursively, if a TLD deregisters a
domain all other DNS servers will be unable to properly forward and
cache the site.  Domain name registration is only really a risk where
undesirable content is hosted on TLD controlled by the censoring
country, such as .cn or .ru Anderson-2011.
As Domain Names are resolved recursively, if a TLD deregisters a
domain all other DNS servers will be unable to properly forward and
cache the site.  Domain name registration is only really a risk where
undesirable content is hosted on TLD controlled by the censoring
country, such as .cn or .ru Anderson-2011 or where legal processes in
countries like the United States result in domain name seizures and/
or DNS redirection by the government Kopel-2013.