I think you're right that DNS, TLS certificates, and ISPs are all chokepoints. Maybe something like i2p bridges or something could overcome that. But that's not specific to nostr, so we have the help of the broader freedom tech community available to us.