Hacker News Reader

No it can potentially ensure integrity between the a client and the first TLS hop that’s about it.

You don’t know which client it actually came from and you can’t ensure integrity within the transaction flow of your app.

Say the request terminated at a LB proxy then passed through and API gateway into an MQ then goes through multiple servers you need some form of integrity checking for the request and OAUTH 2.0 doesn’t provide it.

Wouldn't this be a reasonable reason if you consider that they might use additional equipment to terminate HTTPS connection in an early layer of their network?

no. You don't know where the TLS terminates.

Breaking IP (e.g. MITM the server) means you get a TLS certificate anyway. This might be easier done than said[1].

Breaking IP might not even be necessary because programmers are dumb[2].

[1]: https://www.bleepingcomputer.com/news/security/dns-poisoning...

[2]: http://web.archive.org/web/20120317165131/http://forum.devel...