Besides what others have pointed out, there&#x27;s also the economic angle. It may be worth the estimated $X (for whatever value of $X you believe) to predict a collision, forge a cert, and MITM all of a website&#x27;s traffic. It may not be worth nearly as much if the prize is only the ability to MITM 2% of that website&#x27;s traffic. Maybe it&#x27;s 6% under oppressive regimes, but it&#x27;s still the same amount of work for a much smaller prize.<p>Of course we&#x27;d like to protect all 100%, but this is about tradeoffs. Assuming downgrade attacks are as preventable as they claim, I think it&#x27;s respectable that they&#x27;re making this kind of effort to reduce the impact.