The "internal" flavour needs to be supported on everything. From web servers to databases and so on. And that'd include cases where it needs to be supported on

The "internal" flavour needs to be supported on everything. From web servers to databases and so on. And that'd include cases where it needs to be supported on external-facing systems (proxies). It also means pretty much every popular TLS library and tool needs to support the "internal" version. And it also means that any switch to enable the weaker ciphersuites will end up getting turned on most of the time "to make sure it works". The only realistic place you might differentiate between internal and external is popular browsers like Chrome or Firefox. They could only disable PFS in case they're configured to do so via Group Policy or something like it. In the end, this is just a matter of tooling, and hurting the protocol because they want to load keys into monitoring platforms is a bad idea. Instead, they should have host-level hooks that dump out the packets before TLS is applied.