Re: New Version Notification for draft-nottingham-http2-encryption-00.txt

We're talking around the same problem. What Mark has proposed allows the
HTTP server to tell the HTTP client two different things:
- The server has an https version of the origin available
- The https version of the origin is / is not expected to validate

My belief is that HTTP clients do not have enough communication with their
TLS stacks to be able to use the second piece of information in a secure
fashion; thus, it should be removed.

Your preference seems to be that we fix TLS so that a web site can offer
TLS in a way that a TLS client would not expect it to validate. That seems
fine, except then there also has to a way to communicate that to both the
HTTP client *and* the HTTP server. Do not assume that an HTTP server knows
the type of certificate and/or validation that is done.