> or (2) the user to install a certificate generated by the person doing the MITM
You mean like that "setup software" Comcast spent ages trying to pretend I had to install just to get things running?
I ran Linux in those days, which always meant a little extra support time but I never had to install jack.