(replying for myself, and for anyone else interested)

Actually I think this might not be too hard. Cloudflare has a relatively small, published list of IP addresses: https://www.cloudflare.com/ips/ and Firefox has a DNS API for extensions: https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... (and kinda mostly not chrome, dev channel only: https://developer.chrome.com/docs/extensions/reference/api/d... )

That's not too hard to plug together, and Firefox even has stuff like `["offline"]` so you can avoid sending any requests at all.

Neat: https://postimg.cc/dLmzHfhJ

So yea, that strategy seems to work. PoC functional, gonna clean it up later.