You seem to think whoever opts into adding it to the pipeline makes the difference (client vs server). It doesn't. Consider that a client in a remove location c

You seem to think whoever opts into adding it to the pipeline makes the difference (client vs server). It doesn't. Consider that a client in a remove location can build in a caching load balancer into their pipeline that you wouldn't realize is present that is built with exactly the same software you would put into your pipeline. Both clients and servers can have TLS terminating things in the chains that perform arbitrary functions. All of them increase attack surfaces and risks of implementation bugs.