Police-States would try to trojan the CA infrastructure anyway – its too much tempting a target. Inspecting proxies work well enough with HTTP 1.1, there's no

Police-States would try to trojan the CA infrastructure anyway – its too much tempting a target. Inspecting proxies work well enough with HTTP 1.1, there's no real need to improve them, and even if we do, it should be done via a proxy mechanism, rather than via sending more things in plaintext than we have. Anyway, HTTPS routers can (and should) terminate SSL, and in that case they can even read the Host from SNI.