There is already an X.680 extension to indicate that secure connection might be wiretapped (for slightly other reason, but the result is the same).

https://tools.ietf.org/html/rfc7169