[Spivak]

I don't know if this is a solvable problem that doesn't require boiling the ocean. Opportunistic TLS would work fine but if the authoritative server for some domain doesn't do TLS then you're kinda stuck.