I'm not buying the argument that middleboxes are incompatible with corporate networks. The IT staff can install their own root certificate on all machines, and then they can decrypt all the traffic they want. What about HSTS? IT can disable that (they have full access to all machines anyways). What about personal devices? Those should connect to a separate network.
In essence: if corporate wants to spy on me, they shall provide me with devices that are set up that way, and with that I know I can't have any expectation of privacy. If I'm using my own device, I want TLS to actually provide security and confidentiality. If that means denying my personal devices access to the corporate network, so be it.
In essence: if corporate wants to spy on me, they shall provide me with devices that are set up that way, and with that I know I can't have any expectation of privacy. If I'm using my own device, I want TLS to actually provide security and confidentiality. If that means denying my personal devices access to the corporate network, so be it.