Then the government will just force ISP DNS not to answer queries for the domain. That's how easy you can block 99% of users, which is good enough.

And eventually, when all our hardware is runs-software-and-settings-signed-by-approved-entity-only, that last 1% can't do anything about it either.