I think people are missing this: > We know that enterprises and education networks have unique needs. These features can be turned on early, customized, or tur

I think people are missing this: > We know that enterprises and education networks have unique needs. These features can be turned on early, customized, or turned off entirely via the HttpsOnlyMode, HttpsUpgradesEnabled, HttpAllowlist, and InsecureContentAllowedForUrls policies. Also a lot of people are talking about internally hosted sites and acting like now you'll have to go pay a CA or something. That is not the case. The worst case scenario is that your internal site will require a click through. If you want to avoid that just issue a certificate yourself for it, either via IP (if Chrome will support that?) or via a domain that you resolve via your router. Or if you control the browser, just... turn this off.