This was my main objection as well, after reading this. Make SPDY a standard, people say it's overengineered, but Goog and MSFT say it'll get us 10% performance

This was my main objection as well, after reading this. Make SPDY a standard, people say it's overengineered, but Goog and MSFT say it'll get us 10% performance benefit. Whatever, I trust them. And hey, think of all the next-generation tcpdump-style tools we'll get to write to decode the multiplexed connections (assuming any existing ones for SPDY won't already suffice). But while you're going to the trouble to push a new version of HTTP, why not put some sort of mandatory encryption in there? Make the browser generate its own RSA key when it's installed? Require pinned self-signed certificates at the absolute minimum? Hell, I'm not an expert, I just want the NSA to have to work harder.