Technically they can do it, but if they will start doing it just to support HTTP/2 then at least they'll build their hacks with the knowledge of the HTTP/2 prot

Technically they can do it, but if they will start doing it just to support HTTP/2 then at least they'll build their hacks with the knowledge of the HTTP/2 protocol. Self-signed certificates sound better than just plain text for compatibility reasons. The user agent shouldn't give any indication to the end user that the connection is secure though.