tl;dr: it turns out that OS-native caching policies aren't really such a great fit for edge caches, varnish should probably have a specific VCL module for intel

tl;dr: it turns out that OS-native caching policies aren't really such a great fit for edge caches, varnish should probably have a specific VCL module for intelligently manage cache poising attacks (even something simple for compactly managing 4XX errors would go a long way).