[geofft]

This requires client buy-in, and (at least as of a couple years ago) 360 Secure Browser did not do interstitials on pages with invalid SSL:

https://cabforum.org/pipermail/public/2015-April/005488.html