Agreed, probably a natively running nsite resolver will help. You can't really trust the gateways to serve legitimate content + the gateway effectively MITM's your signer.

DNS for the primitives like relays /blossom will be around for a while. NoDns can help mitigate DNS risks. Then the main (rugpull) risk left are ip addresses