The problem with half assed work is that you still put in some effort but reap none of the rewards. You work to uninstall Firefox from dozens of computers but get exactly 0 results because now you’ll have to configure Chrome. Default installations of both browsers are perfect for home use but woefully inadequate for controlled networks.

And in the end you put in just about as much effort as changing some flags in any one of the dozens of example config files available on the internet and copying it on every machine.

- Implement a proxy to break SSL.

- Configure the browsers to disable DOH (GPO or local configuration) for as long as it's an option.

- remove all browsers because that's the solution you already have in place.

I wholeheartedly disagree with any resolution that just hides or ignores the issue especially when it's scheduled to become more or less standard.