Cert Pinning and Certificate Transparency should block the decryption, even on a VPN where the user has installed a custom root certificate.

It wouldn't stop them seeing what domains the user is going to (as it's sent in plaintext because of SNI, and ECH was still a few years away).