Why? Do you have some black boxes that keep calling some DoH and you can't control that but they accept user CAs?