You probably want a layer 7 firewall that only allows HTTPS traffic to/from the internet to your terminating proxy. Stuff that doesn't obey the system proxy (o

You probably want a layer 7 firewall that only allows HTTPS traffic to/from the internet to your terminating proxy. Stuff that doesn't obey the system proxy (or a few of the other pitfalls e.g. HPKP) will break, but at least you'd be aware of what's not allowing itself to be intercepted.