So, kill off lan-level caching http proxy servers? (Or force a choice between trust the cache with everything; including email etc - or - no caching of signed s

So, kill off lan-level caching http proxy servers? (Or force a choice between trust the cache with everything; including email etc - or - no caching of signed software updates and common media resources?) I'd be less unhappy about this if web browsers (and application updaters) understood x509 ca cert limits, so you could tell a device to trust the lan cache to impersonate Debian.org, windowsupdate.com and BBC.com - but not Gmail.com...