So now the flip side question. How would say a corporate SSL&#x2F;TLS proxy, which is effectively a MITM, bypass this security feature? I can see the TOFU is easy to defeat by dropping the header before it gets to the client, but what if they&#x27;re allowed to roam on and off the proxy?