Is it possible to add root CA's for DoH only, so that I can intercept requests at the gateway and terminate the TLS connection there?

Can anyone link to the part of the source tree containing their DoH implementation? I would like to test whether it is possible to distinguish Firefox DoH from unbound.