You don't have to. Proxy handles the request and just gives response back to you signed with national cert. If you don't install it, your browser will just start complaining about every site. At least that is how Bluecoat ProxySG[1] works at my employee.

[1] https://bto.bluecoat.com/webguides/proxysg/security_first_st...

For SSL traffic, yes, but that wouldn't stop someone from using a different encryption protocol.

country wide, this is a loud call for a cloud, distributed proxy provider with a better track record than the telco, to offer tor-like tunnels to at least exit the MITM zone.