"The first scenario is just very unlikely."<p>From another perspective: I worked on the content filter for Parental Controls at Apple. My understanding is that every filtering proxy product with SSL support requires the installation of an insecure certificate. That, or they do a fairly rudimentary IP or reverse-DNS based filtering (which is the route we chose for Parental Controls) for secure connections.<p>These vendors certainly claim to have a lot of Fortune 500 clients.