I feel like I read some authoritarian countries were trying to compromise SSL at the ISP/host level.

How does this avoid DNS blocking?