Not proving that a local network doesn't have an encrypted resolver

[chris-box]

On the thread, we discussed limiting the capabilities of this attacker to not worry about proving that a local network doesn't have an encrypted resolver, etc. Chris Wood, can you help here?

Originally posted by @tfpauly in #2 (comment)

[chris-box]

Tiru said: An on-path attacker typically will not be always present in the network; the client can remember that a network-provided encrypted resolver is provided by the network (e.g., store the certificate fingerprint or authentication domain name associated with SSID:BSSID). If the endpoint cannot discover the network-provided resolver when it re-attaches to the network, it can assume an attacker blocked the discovery.