I don't see a problem here. Just try TLS first always. If it fails and you haven't seen a STS flag for the server, then try plaintext. This should work with any

I don't see a problem here. Just try TLS first always. If it fails and you haven't seen a STS flag for the server, then try plaintext. This should work with any protocol. There's not a whole lot of gain from doing this, except SSL client libs could provide an API for it rather than having to munge every higher protocol to support some kind of STS mechanism.