I wonder if (in theory) it wouldn't make more sense to address this sort of thing at the system resolver level rather than in the browser, the way tor does.