This makes no sense at all. TLS encryption does happen on the client side.
If you want to protect the actual contents you should encrypt it within your application and not rely on the TLS layer to protect it as various products, tools and services strip off this layer (for better or worse)
Lots of people think you can protect your data just by using TLS which is false. If you don’t believe that try using mitmproxy or fiddler.
But those will give a TLS error unless the endpoint is already pwned.
Of course outside of the enterprise phishers will use a variety of other tricks as they are not in control of your CA list you trust (as you mention here) on your device. So they’ll for e.g. use domain names that either look legit or are very close to a real domain.
Lookalike domain names don't imply that TLS is broken. The guarantee from TLS is that you're talking to the owner of the domain you connect to, which is still true if you connect to the wrong one.