[tptacek]

Those proxies publish their fake CA=YES certs, so you can just add them to your root and everything will validate.