I've toyed with the idea of MITMing all connections and blocking any that I can't decrypt, but too much software has pinned certificates these days. (Too much for me, not in general)