Yes, but they would also need a valid TLS certificate?

A country's government could also take over the TLD and grab its traffic overnight.