Their company is attempting to hijack TLS connections to eavesdrop on their browsing.
It only works with websites that also offer a non-TLS version (which the hijacker uses to fetch content and then re-encrypts with their own certificate after they’ve snooped). But it doesn’t work if the website doesn’t have a non-TLS version and/or specifies it should only be used with TLS.
Another way for it to work is for the company to get their own certificates on the machine, which is very easy if it’s a work-issued machine. But I’m guessing OP is not using a work machine.
I don’t think it’s the same with Discord because you already know which server you want to join, even if there are hurdles.
With federated instances you are told they all do the same thing and that it doesn’t matter, but in the same breath you’re told there’s still criteria to consider (number of users, location, some have a main theme etc.)
It’s not a cost issue. It’s about taking responsibility for maintaining a reliable, highly-available service.
I’m pretty sure a solution will be found eventually. EU institutions need IT infrastructure to work and communicate like everybody else and all EU countries have highly available infrastructure like emergency services, secure channels etc. It’s just a matter of putting this task in the right context.
It’s a very good thing that they’ve stumbled across this snag because solving it can also open the way for running more internet public services in the EU in an open, transparent manner, and may open the way to weaning ourselves off commercial platforms.
Having a distributed, federated, secure, privacy-friendly and open EU-run messaging platform for example would be a huge boon for its citizens and have wide implications for other regions as well.