> Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? In theory, yes, apart from th

> Is better TLS interception actually possible? Is it just that it's usually badly implemented, or is it a fundamental weakening? In theory, yes, apart from the obvious "more attack surface" problem. They could check for HPKP, CRLset, CT. They could even do more. (CT checking is very basic in Chrome and nonexistent in other browsers.) However in reality? No. In the real world Bluecoat manages to break TLS 1.3 deployment, although its designers tried everything to avoid that and they have been asked by Google to test that.