It's certainly not a trivial thing to design, but the "GET https://..." https://..." proposal floating around solves a lot of the relatively benign cases (compa

It's certainly not a trivial thing to design, but the "GET https://..." https://..." proposal floating around solves a lot of the relatively benign cases (company/school smut-proxies etc.) My point is that HTTP/2 didn't even try, because the political agenda for a lot of people were more or less "death to all client side proxies". They're entitled to that opinion of course, but given that laws in various countries say the exact opposite, the only thing they achieve by not making space for it in the security model is that the security model will be broken.