And Putin threatened with asymmetrical answer to West's sanctions.

Another motive.

Did not found way to force system resolver to use tcp-only, but something like this should work:
aptitide install pdnsd
=== cut /etc/pdnsd.conf ===
global {
query_method = tcp_only;
}
server {
ip = 8.8.8.8, 8.8.4.4;
label = "google";
}
=== cut /etc/resolv.conf ===
nameserver 127.0.0.1
That's slower than udp, but better than nothing (and pdnsd cache will compensate slowdown from tcp usage).

But then I need every time verify HTML code (including javascript [obsfucation + halting problem!]), to ensure it did not modified by MITM to direct somewhere else.

When login page is https - I'm know that page code did not modified by MITM.