Comment by EvanAnderson

That's exactly what the "NoLongerEvil" Nest thermostat server did[0]. They just injected their own CA bundle and modified the /etc/hosts file to "free" the devices.

[0] discussed https://news.ycombinator.com/item?id=45813343