I am curious if a middlebox could not inject forged packets into my dncrypt transmissions, making it appear that it did not reach the destination but is merely a DoS spoof attack by rogue agencies. Middleboxes can also drop packets based on various policy. So a traceroute might appear that it is blocked in another country but how certain can we be these ICMP packets have not been spoofed and forged one way, and blocked the other way as well?