I'm not sure that this is a 100% correct proposal, but it definitely seems like the right direction. To the author's point -- setting up transport encryption should be painless, not the awful experience it is today.