> Corporate environments tend to have their own CA infrastructure, so this isn't much of a problem for them. That's a very broad statement. Some corporate envi

> Corporate environments tend to have their own CA infrastructure, so this isn't much of a problem for them. That's a very broad statement. Some corporate environments certainly do, and so this isn't much of a problem for them. But some corporate environments certainly do not, and so this is a problem for them. What you're essentially doing here is requiring that all corporate environments that don't currently have a CA infrastructure deploy one instead of using HTTP caching that works today. You're positively encouraging CA MITMing here.