They can just make it a legal requirement to allow MITM, like Kazakhstan tried doing back in 2015. If every ISP requires you to have this cert installed before you can go online, you don't have many options.