This idea of forbidding middlebox from messing up things sounds great. I have an honest question here though.
What stops a middle box from terminating all QUIC connections (and therefore get access to decrypted content)?
What stops a middle box from terminating all QUIC connections (and therefore get access to decrypted content)?
Of course in a corporate environment you can trust the middlebox's CA on all the work machines. That's actually fine. What everyone seems to hate here is middleboxes that don't terminate connections and try to mess with them in other ways.