It seems like the solution is to special case sensitive headers like "Cookie", so that the compressed version doesn't leak information. But isn't every byte equally worthy of protection? What if there's sensitive information in the body?

(I get that the format of the Cookie header is probably much more structured/predictable than usernames or account details that might appear in the body, but surely a good cryptosystem would be 100% resistent to these sorts of side-channel attacks, without any need to guess which headers need to be handled more carefully.)