Would probably look more like auto deny with user override if they choose, with a setting to white list the domain. User should have to opt into their connection being MITMd.