I'll take the bait.

Can't you just enroll your kid's devices in your home corporate and leverage MDM to force the network to call through your proxy, which denies or downgrades all ECH and then can actively filter to an allowlist or screen the material through your personal or contracted LLM?

This seems relatively solved to me.