True, it's a bad idea. But we're getting to the heart of the issue now. What enterprises insist on being able to do is at odds with the security the TLS workin

True, it's a bad idea. But we're getting to the heart of the issue now. What enterprises insist on being able to do is at odds with the security the TLS working group is trying to give users (and service providers like Google and Apple). These must-decrypt-tls-traffic enterprises should do it in a way that costs them, in a way that exposes them to risks - not in away that puts risks on other users and service providers. For just debugging, they can have the endpoints which they are debugging dump the plaintext, I agree that's a better way. But let's be honest, they're mostly not debugging, they're trying to deal with intrusions, outbreaks, and untrusted employees.