There are many downsides. First, a response without the redirect is still a "successful" request. This easily allows a middle man to observe and modify the res

There are many downsides. First, a response without the redirect is still a "successful" request. This easily allows a middle man to observe and modify the response and request. With a 301 redirect, the server is not sending any html/json/etc content to the server - just the header. Search engines, HTTP caches, bookmark managers, etc they all accept and update their indices upon 301 redirects. Non-browser user agents are unlikely to read and interpret CSP headers. I am firmly set that these older user agents without SSL support, or ones with old vulnerable implementations are not worth supporting. You are taking the security level of everyone down, just to support that likely minority. They are already having problems with several other sites. They upgrading their hardware/software is the easier compromise to make, compared to the web site lowering the security for everyone.