> Can we count on ISPs not mucking with stuff at the transport layer?

That used to be common in the past, many ISPs ran transparent HTTP proxies to reduce the use of their slow upstream links. The current push to use strong encryption and authentication everywhere (for instance, plain HTTP without TLS has become rare) makes it much harder.