And gov.spy can try force your device connect to gov.spy instead x (dns poison, isp force ip redirect, …).

Internet rely on dns and ip. CA only relevant for internet communication. Take more, but not much more.