Thats fair, but an enterprise instalation I saw used a transparent proxy and certs on client machines. By transparent proxy I mean a DPI firewall that somehow "hijacked" normal TLS sessions. I don't really know why, a HTTP proxy would be the obvious solution ...