Disclosing secrets per session requires a lot more work on the endpoints. Especially because it is an active service. That also leaves a lot more attack-surface

Disclosing secrets per session requires a lot more work on the endpoints. Especially because it is an active service. That also leaves a lot more attack-surface on the end-points. It also creates quite a bit of sensitive network traffic. Things get more hectic if you want 'live' TLS-inspection. As such, I can definitely see why TLS inspectors don't like the myriad of opportunities for mistakes created by disclosing secrets at the end-points. The counter-argument would be that, if you really need TLS-inspection your security should be tight enough that disclosing the secrets should not be the hardest thing you are implementing. Moreover, neither should the world compromise its own encryption to make your targeted (and rarely required) ability to break encryption safer.