Cras

Firefox, Chrome, Edge, will all warn you about self-signed certs or cert mismatches but allow you to continue. You’re completely correct that SSL/TLS needs a certificate, but it doesn’t need to be CA issued or in any way legitimate for the encrypted tunnel to be established

You don’t really ‘need to’ in a world where a good proportion of people will happily click ‘continue anyway’ when they get any sort of certificate error

You’re right that they’re absolutely not the same, however at a nation state level, I’d be very surprised if you could point to any communist regime at any point in history that wasn’t also authoritarian or didn’t end up that way

Changing your DNS doesn’t stop your ISP seeing what sites you visit unless you use a VPN. DNS just resolves an address to an IP. Your requests (with destination IP attached) will still pass through their network gear and be able to be logged should they wish to.