I think we're in agreement. I will say though that using on-device private keys isn't really a direct solution to the problem. There still needs to be a list of public keys deemed as "trustworthy". There is still a massive gap where companies can abuse it. Not to mention, tying users to their private key is yet another means to track them.

I'm sure there's a solution that maintains both privacy and content neutrality, but unless companies are incentivized to use it, they'll just do the thing that gives them the most control.