&gt; HTTP&#x2F;2 is not TLS-only, even though major browsers will only use it over TLS.<p>Which in practice will (hopefully) make it TLS-only.  As I recall, one of the original motivations to require TLS, and one of the reasons browsers plan to mandate TLS (apart from the obvious), was specifically to avoid broken &quot;transparent&quot; proxies.<p>&gt; And even when over TLS, the TLS connection might terminate in a separate machine, it going cleartext the rest of the way.<p>If the server uses a TLS frontend device and passes cleartext to a backend, then apart from that being a really bad idea from a security perspective, they should know better than to allow that to pass through a broken transparent proxy.