cooperative as in devices that users have elected to use? Additionally, it isn't clear as to why DoH presents a challenge when malware can already communicate to Youtube for example to download its payload. The chances of blocking Youtube are negligible.