I should also mention that I am not asking about defenses in particular applications, such as Tor, which does include hardcoded certs. I am more interested in everyday use while not using specialized services such as VPN clients and Tor.